[opensourcedex]

SkillSpector is a free, open source ai security & privacy project written in Python and released under Apache-2.0. It has 17,624 GitHub stars, 1,504 forks and 136 open issues, and was last pushed 8 hours ago. On this registry it ranks #3 of 34 tracked projects in AI Security & Privacy, with 5 head-to-head comparisons available. It gained 298 stars over the last 3 tracked days.

What is SkillSpector?

SkillSpector is an open-source security scanner for AI agent skills that detects vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risk in Claude Code, Codex CLI, Gemini CLI, and MCP skills before they are installed — built for developers who install agent skills and for security teams that vet or publish them.

What it is

SkillSpector is a Python tool that scans agent skills and reports whether a given skill is safe to install. It is licensed under Apache-2.0 and targets Python 3.12+. It is part of the NVIDIA Verified Skills pipeline, which scans, evaluates, and signs agent skills before publication; skills that pass are published to the NVIDIA skills catalog. The project lives in the Claude Code, Codex, and MCP ecosystems, and its topic set — agent-security, agent-skills, prompt-injection, supply-chain-security — describes exactly that niche.

The concrete problem it solves is unvetted installation. Agent skills execute with implicit trust and minimal vetting, so a malicious or careless skill runs with the same reach as the agent that loads it. SkillSpector answers one question — "Is this skill safe to install?" — and it replaces manual reading of skill source before an install. The scale of the issue is documented in the README: in the 31,132-skill analyzed subset of the research dataset, 26.1% of skills contain vulnerabilities and 5.2% show likely malicious intent.

Key capabilities

  • 71 vulnerability patterns across 17 categories, including prompt injection, data exfiltration, privilege escalation, supply chain, excessive agency, output handling, system prompt leakage, memory poisoning, tool misuse, rogue agent, anti-refusal, trigger abuse, dangerous code via AST, taint tracking, YARA signatures, MCP least privilege, and MCP tool poisoning.
  • Multi-format input: scan Git repositories, URLs, zip files, directories, or a single file.
  • Two-stage analysis combining fast static analysis with optional LLM semantic evaluation.
  • Live vulnerability lookups: the SC4 check queries OSV.dev for real-time CVE data, with automatic offline fallback.
  • Four output formats: terminal, JSON, Markdown, and SARIF reports.
  • Risk scoring on a 0–100 scale with severity labels and clear recommendations.
  • Baseline and false-positive suppression via glob rule or fingerprint baseline, so re-scans surface only new issues.

Who uses it and how

  • Individual developers running a scan against a skill before installing it into Claude Code, Codex CLI, or Gemini CLI.
  • CI and security workflows consuming SARIF output, with scans used to gate installs.
  • Publishers in the NVIDIA Verified Skills pipeline, where skills are scanned, evaluated, and signed before reaching the NVIDIA skills catalog.
  • Agent-session users who install the Pi extension described in docs/PI_EXTENSION.md and scan skills from inside a session.
  • Security teams triaging repeated scans, using baselines to keep known findings quiet and highlight only new ones.

Getting started

Install with uv tool install git+https://github.com/NVIDIA/skillspector.git, or use uv tool install 'skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git' if you plan to run skillspector mcp. Source installs use make install after creating a virtual environment, and a Dockerfile based on python:3.12-slim-bookworm supports make docker-build for a Python-free path.

How it compares

The facts name no comparable scanner tools, so SkillSpector stands alone in this registry on that axis. Its distinguishing position is pipeline membership: it is one stage of the NVIDIA Verified Skills pipeline and feeds the NVIDIA skills catalog.

When to use it — and when not to

A self-hoster must provide Python 3.12+ or build the Docker image, and the LLM semantic evaluation stage is optional and therefore extra setup. OSV.dev lookups need network access, though an automatic offline fallback exists, and the suppression baseline is state that someone must maintain. Anyone wanting a fully hosted scanning service should look elsewhere: the homepage is a hosted guide on when to scan, how to read a report, and how to gate installs, not a managed scanner. Note also the fail-closed resource bounds documented in docs/ANALYSIS_RESOURCE_BOUNDS.md, which cap bundle, parser, nested-artifact, ledger, and finding sizes, and the 136 open issues against a project last pushed on 2026-09-16.

project readme (upstream, from github) — read inline

SkillSpector

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills.

Python 3.12+ License: Apache 2.0 OpenSSF Scorecard HVTrust

Overview

AI agent skills (used by Claude Code, Codex CLI, Gemini CLI, etc.) execute with implicit trust and minimal vetting. In the 31,132-skill analyzed subset of the research dataset, 26.1% of skills contain vulnerabilities and 5.2% show likely malicious intent.

SkillSpector helps you answer: "Is this skill safe to install?"

SkillSpector is part of the NVIDIA Verified Skills pipeline, which scans, evaluates, and signs agent skills before publication. Skills that pass are published to the NVIDIA skills catalog.

Documentation

Features

  • Multi-format input: Scan Git repos, URLs, zip files, directories, or single files
  • 71 vulnerability patterns across 17 categories: prompt injection, data exfiltration, privilege escalation, supply chain, excessive agency, output handling, system prompt leakage, memory poisoning, tool misuse, rogue agent, anti-refusal, trigger abuse, dangerous code (AST), taint tracking, YARA signatures, MCP least privilege, and MCP tool poisoning
  • Two-stage analysis: Fast static analysis + optional LLM semantic evaluation
  • Live vulnerability lookups: SC4 queries OSV.dev for real-time CVE data with automatic offline fallback
  • Multiple output formats: Terminal, JSON, Markdown, and SARIF reports
  • Risk scoring: 0-100 score with severity labels and clear recommendations
  • Baseline / false-positive suppression: Accept known findings via a glob-rule or fingerprint baseline so re-scans surface only new issues (docs)

Quick Start

Installation

Open-source software notice: This project will download and install additional third-party open source software projects. Review the license terms of these open source projects before use.

Create and activate a virtual environment first (all make targets assume the venv is active). Use uv or pip; the Makefile uses uv if available, otherwise pip.

Quick install with uv (CLI-only):

uv tool install git+https://github.com/NVIDIA/skillspector.git
# Update later: uv tool update skillspector

If you plan to run skillspector mcp, install the MCP extra at install time:

uv tool install 'skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git'

From source:

# Clone the repository
git clone https://github.com/NVIDIA/skillspector.git
cd skillspector

# Create and activate virtual environment
uv venv .venv && source .venv/bin/activate
# or: python3 -m venv .venv && source .venv/bin/activate

# Install for production use
make install

# Or install with development dependencies
make install-dev

Docker (no Python required)

Run SkillSpector without installing Python by building it locally from the included Dockerfile. The image is based on the Docker Official Python 3.12-slim-bookworm image.

Build the image:

make docker-build
# or: docker build -t skillspector .

Scan a local directory by mounting your current directory into /scan, the container's working directory:

docker run --rm -v "$PWD:/scan" skillspector scan ./my-skill/ --no-llm

Scan with LLM analysis by passing credentials with a local .env file:

cat > .env <<'EOF'
SKILLSPECTOR_PROVIDER=anthropic
ANTHROPIC_API_KEY=sk-ant-...
EOF

docker run --rm \
  -v "$PWD:/scan" \
  --env-file .env \
  skillspector scan ./my-skill/

Or pass credentials directly from your shell environment:

docker run --rm \
  -v "$PWD:/scan" \
  -e SKILLSPECTOR_PROVIDER=anthropic \
  -e ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY" \
  skillspector scan ./my-skill/

Write a report to the host filesystem by writing to the mounted directory:

docker run --rm \
  -v "$PWD:/scan" \
  skillspector scan ./my-skill/ --no-llm --format json --output report.json

Optional alias for repeated static scans:

alias skillspector-docker='docker run --rm -v "$PWD:/scan" skillspector'
skillspector-docker scan ./my-skill/ --no-llm

Basic Usage

# Scan a local skill directory
skillspector scan ./my-skill/

# Scan a single SKILL.md file
skillspector scan ./SKILL.md

# Scan a Git repository
skillspector scan https://github.com/user/my-skill

# Scan a zip file
skillspector scan ./my-skill.zip
Size limits

SkillSpector enforces two independent caps on remote and archive inputs to bound the impact of oversized downloads and zip bombs:

  • Per-ingest cap: INGEST_MAX_BYTES (100 MiB) — applied to streamed URL downloads, total uncompressed size of zip archives, and post-clone disk usage of Git repos.
  • Zip member cap: INGEST_MAX_ZIP_MEMBERS (10,000) — caps the number of entries in a single zip.

Note that the per-file 1 MB analysis cap (MAX_FILE_BYTES) is a separate, downstream limit: it bounds what individual analyzers will read out of an already-ingested directory. The ingest caps above bound how much content can land on disk in the first place. A breach of either ingest cap fails closed with an IngestLimitExceededError.

Output Formats

# Terminal output (default) - pretty formatted
skillspector scan ./my-skill/

# JSON output - machine readable
skillspector scan ./my-skill/ --format json --output report.json

# Markdown output - for documentation
skillspector scan ./my-skill/ --format markdown --output report.md

# SARIF output - for CI/CD integration and IDE tooling
skillspector scan ./my-skill/ --format sarif --output report.sarif

Batch Scanning

Scan entire directories of skills in parallel from contrib/batch_scan/:

python -m contrib.batch_scan.batch_scan ./my-skills/ --no-llm
python -m contrib.batch_scan.batch_scan ./my-skills/ --workers 20 -f json -o report.json
python -m contrib.batch_scan.batch_scan ./tests/fixtures/ -f terminal --workers 20

Supports multilingual detection (zh/ja/ko) and terminal/JSON/Markdown output.

For LLM scans with higher concurrency, configure multiple API keys following .env.example — the pool improves throughput and resilience, provided the keys don't share an account-level rate limit.

See the contrib guide for details.

Note on LLM support: The default configuration targets DeepSeek as the cheapest public option. DeepSeek-Chat is expected to sunset, and the contributor does not have hardware to test against local models. The batch scanner was originally tested with OpenAI-compatible endpoints — DeepSeek's lack of structured-output support required manual JSON-parsing patches. If you can contribute a more universal backend (Ollama, vLLM, or a different provider), PRs are very welcome.

Suppressing False Positives (baseline)

Suppress known/accepted findings so the risk score reflects only un-triaged issues and re-scans surface only new findings. See the suppression guide for the full reference.

# Accept all current findings into a baseline (run once), then commit it.
skillspector baseline ./my-skill/ -o .skillspector-baseline.yaml

# Scan against the baseline — only NEW findings are reported and scored.
skillspector scan ./my-skill/ --baseline .skillspector-baseline.yaml

# Review what was suppressed (still excluded from the score).
skillspector scan ./my-skill/ --baseline .skillspector-baseline.yaml --show-suppressed

A baseline can also use drift-tolerant glob rules (by rule id, file path, or message) — see .skillspector-baseline.example.yaml. Exact fingerprint baselines are evidence-bound: changing the s

readme truncated — read the full docs on github

Frequently asked questions

Is SkillSpector free to use?

SkillSpector is open source under the Apache-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does SkillSpector do?

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in

What is SkillSpector written in?

SkillSpector is primarily written in Python. Its source is publicly available at https://github.com/NVIDIA/SkillSpector, and it has 17,624 GitHub stars.