SkillSpector
Overview
Open-source security scanner for agent skills that detects vulnerabilities, malicious patterns, and risky behaviors before installation.
SkillSpector is an open-source NVIDIA project for scanning AI agent skills before they are installed or used. It is designed for skills used by tools such as Claude Code, Codex CLI, Gemini CLI, and similar agent environments where skills may execute with implicit trust. The scanner supports Git repositories, URLs, zip files, directories, and single files. According to the official repository, it checks 68 vulnerability patterns across 17 categories, including prompt injection, data exfiltration, privilege escalation, supply chain risks, excessive agency, output handling, system prompt leakage, memory poisoning, tool misuse, rogue agent behavior, anti-refusal behavior, trigger abuse, dangerous code analysis, taint tracking, YARA signatures, MCP least privilege, and MCP tool poisoning. SkillSpector uses a two-stage approach with fast static analysis and optional LLM-based semantic evaluation, and it can query OSV.dev for live vulnerability data. It is useful for developers and security teams that need to vet third-party or internal agent skills before adoption.
Autonomy level
15/100
Our subjective rating of how independently the product carries out its documented tasks, considering the human setup, input, approval and review it needs. This is not a measured success rate.
Comparisons
Custom Comparisons
Some of the use cases of SkillSpector:
- Scanning agent skills before installation
- Detecting prompt injection and data exfiltration risks
- Reviewing third-party skill repositories for malicious patterns
- Checking agent skills for supply chain and privilege escalation issues
- Adding security review to agent development workflows
- Evaluating MCP-related least privilege and tool poisoning risks
Loading Community Opinions...
Pricing model:
Code access:
Popularity level: 54%
Tags:
Turn this profile into a trust signal
Show prospects that SkillSpector has a public place where they can check product details, pricing, ratings, and reviews.
Build confidence
Give buyers a third-party profile to explore.
Reduce hesitation
Put validation beside your strongest CTA.
Earn discovery
Every badge links prospects to your listing.
Choose your style
Preview it, then copy the complete embed code.
Shows buyers where to validate your product, pricing, and reputation.
Plain HTML. No signup, script, or maintenance required.
AI Agent Store · Specialist AI agentsFor ai application security consultancies
Your AI agent for agent extension security reviews.
Exploring SkillSpector? For AI application security consultancies, your own AI agent can scope AI security assessments, test application failure modes, and verify client remediation. Start with a setup tailored to this work.
- ✓ Scope AI security assessments
- ✓ Test application failure modes
- ✓ Verify client remediation
Tailored starting setup. Chat on our site. See the workflow and monthly plan.