SkillSpector

Overview

SkillSpector is a security scanner for AI agent skills. It helps answer whether a skill is safe to install by running fast static checks by default and optionally adding LLM semantic analysis. It accepts Git repositories, URLs, zip files, directories, and single files, and is part of the NVIDIA Verified Skills pipeline.

Key Features

• Multi-format input: scans Git repositories, URLs, zip files, directories, and single files.
• Covers prompt injection, data exfiltration, privilege escalation, supply-chain issues, excessive agency, output handling, system prompt leakage, memory poisoning, tool misuse, rogue-agent behavior, trigger abuse, dangerous code patterns, taint tracking, YARA signatures, and MCP
• Two-stage analysis: fast static checks by default plus optional LLM semantic evaluation of claimed versus actual behavior.
• Live vulnerability lookups through OSV.dev with automatic offline fallback.
• Outputs terminal, JSON, Markdown, and SARIF reports.
• Risk scoring from 0 to 100 with severity labels and recommendations, plus baseline suppression of known findings.

Use Cases

• Reviewing a third-party agent skill before installing it.
• Scanning local directories, single SKILL.md files, Git repositories, or zip files during development.
• Gating releases or CI pipelines with SARIF and JSON reports.
• Batch auditing directories of skills or comparing MCP Registry snapshots.

Getting Started

• Install the CLI with uv, or clone the repository and run make install from an activated virtual environment; Docker is also available.
• Run skillspector scan against a local skill directory, a SKILL.md file, a Git repository, or a zip file.
• Static checks run by default; configure an OpenAI-compatible LLM provider to add semantic analysis.
• Use the format option to produce terminal, JSON, Markdown, or SARIF output.

Deployment & Requirements

• Python 3.12+ and a virtual environment for source or CLI installation.
• Docker is optional and requires no local Python install; the image is based on Python 3.12-slim-bookworm.
• Semantic analysis requires an LLM provider configuration and credentials; static analysis does not.
• Live OSV.dev lookups require network access, with an offline fallback available.

Before You Adopt

• License: Apache-2.0. Review its terms before using, modifying, or distributing the project.
• Semantic review depends on an external LLM provider and its credentials.
• Live dependency vulnerability data depends on OSV.dev, though an offline fallback exists.
• Installing the project may download third-party open source software, so review those licenses.
• The Codex CLI provider is disabled because its sandbox can read host files.
• The batch scanner defaults to DeepSeek, and DeepSeek-Chat is expected to sunset.