Directory · Skills

SkillSpector

Security scanner that checks Claude Code, Codex, and MCP skills for prompt injection, exfiltration, and supply-chain risks before install.

★ 20,162 stars · last updated 2026-10-14 · Free, open source · View on GitHub

Best for

• Vetting third-party agent skills or SKILL.md files before installing them
• Gating skill installs in CI/CD with SARIF or JSON reports
• Batch scanning large skill collections or MCP registry snapshots
• Tracking only new findings over time using baseline suppression

Install

uv tool install git+https://github.com/NVIDIA/skillspector.git

Our take

Combines static analysis across 71 patterns in 17 categories (including AST, taint tracking, YARA, and MCP tool poisoning) with optional LLM semantic evaluation, and produces a 0-100 risk score. It is part of NVIDIA's Verified Skills pipeline and offers Docker, MCP server, Pi, and OpenCode integrations. The contrib batch scanner defaults to DeepSeek, which the README notes is expected to sunset, and LLM analysis requires your own provider API key.

Similar skills

• Karpathy-Inspired Claude Code Guidelines: A single CLAUDE.md with four principles to curb overengineering, silent assumptions, and unrelated edits in Claude Code.
• Scientific Agent Skills: Library of 177 Agent Skills for scientific work in biology, chemistry, medicine, and more, for Claude Code, Cursor, Codex and others.
• reverse-skill: Skill router pack for reverse engineering, pentesting, and security research that routes AI coding agents to the right methodology and toolchain.
• book-to-skill: Converts technical books and document folders (PDF, EPUB, DOCX, MD, HTML and more) into on-demand agent skills for Claude Code and others.
• Hallmark: Design skill for Claude Code, Cursor, and Codex that builds, audits, and redesigns UI while avoiding generic AI-generated looks.
• Claude Skills: Large MIT-licensed library of skills, agents, and slash commands for Claude Code, Codex, Gemini CLI, Cursor, and other coding agents.