SkillSpector

MCP server

Security scanner for agent skills

Use it when you want to scan an agent skill for risks before installing it

A free security scanner that scores the risk of Claude agent skills and checks them for hidden malicious instructions.

Added to the shelf 19 Oct at 01:00

From the makersREADME, read 17 Oct

SkillSpector is a security scanner for AI agent skills, checking Claude Code, Codex CLI, Gemini CLI and MCP skills for vulnerabilities, malicious patterns, prompt injection, data exfiltration and supply-chain risks before installation. It scans Git repos, URLs, zip files, directories or single files, combining fast static analysis with optional LLM semantic evaluation. It produces terminal, JSON, Markdown and SARIF reports with a 0-100 risk score. It is part of the NVIDIA Verified Skills pipeline.

Install

uv tool install git+https://github.com/NVIDIA/skillspector.git

Commands

skillspector scan ./my-skill/
Scan a local skill directory
skillspector scan ./my-skill/ --no-llm
Run static analysis only

Install

Commands

Kinds of work

Install

Commands