NVIDIA/SkillSpector
Some data may be outdated — see provenance labels.
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them. observed · 2026-09-23
Health v2 · maintenance only
79/100
- Activity 96
- Release rhythm 94
- Longevity 15
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-10-21. Adoption (stars, forks) is never an input.
- gap_med: 2
- age_days: 214
- days_rel: 41
- days_push: 28
- n_releases_24m: 16
Adoption not part of the score
18115 stars · 1569 forks observed · 2026-09-23
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded
SkillSpector is a security scanner for AI agent skills used by Claude Code, Codex CLI, Gemini CLI, and MCP-based agents. It detects vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risks before a skill is installed, using static analysis plus optional LLM semantic evaluation.
Use cases
- scan an agent skill for prompt injection before installing it
- check if a Claude Code skill is safe to install
- detect data exfiltration patterns in MCP skills
- audit agent skills for supply-chain risks
- generate SARIF reports for skill security findings
- gate skill installation in CI with a risk score
- suppress known false positives in skill re-scans
When to choose
- you install third-party agent skills and want to vet them first
- you publish agent skills and need a security tier in your release pipeline
- you need SARIF/JSON security reports for agent skill bundles
- you want CVE lookups via OSV.dev plus static and semantic analysis in one tool
When to avoid
- you need general-purpose SAST for ordinary application code
- you need runtime sandboxing or enforcement rather than pre-install scanning
- you need a GUI-based security dashboard
Facets
cli-tool · maturity active
security vulnerability-scanning linter developer-tools dependency-audit security developer-tools large-language-models python cli cross-platform agent-skills prompt-injection mcp claude-code supply-chain-security sarif llm-analysis yara ai-agents
9 sources
- readme: https://github.com/NVIDIA/SkillSpector · fetched 2026-09-23 · 8662aedb95c9
- homepage: https://docs.nvidia.com/skills/scanning-agent-skills · fetched 2026-10-12 · a6b9db7c506d
- site_page: https://docs.nvidia.com/skills/advanced-install · fetched 2026-10-12 · e3a639eb4cab
- site_page: https://docs.nvidia.com/skills/agent-skill-trust-pipeline · fetched 2026-10-12 · f4e7beb7f38a
- site_page: https://www.nvidia.com/en-us/about-nvidia/privacy-policy · fetched 2026-10-12 · ffbd11b993c0
- site_page: https://www.nvidia.com/en-us/about-nvidia/privacy-center · fetched 2026-10-12 · b098377da9cc
- site_page: https://www.nvidia.com/en-us/about-nvidia/terms-of-service · fetched 2026-10-12 · 85469b6ff0a1
- site_page: https://www.nvidia.com/en-us/about-nvidia/accessibility · fetched 2026-10-12 · 8f61ce4143ec
- site_page: https://www.nvidia.com/en-us/about-nvidia/company-policies · fetched 2026-10-12 · b169611fd7d6
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| NVIDIA/SkillSpector | main | 79 |
For agents
markdown · JSON · MCP: product_card(name="NVIDIA/SkillSpector")
Data as of 2026-10-19T08:05:51.212177+00:00 · Report a problem