What languages and platforms does SkillSpector support?

SkillSpector itself is written in Python and requires Python 3.12+. It scans agent skills regardless of the skill's own implementation language, since analysis targets skill manifests, scripts, and metadata rather than a specific app language.

Is SkillSpector free and self-hostable?

Yes. It's licensed under Apache-2.0, runs as a local CLI or Docker container, and can be self-hosted entirely, including an offline static-only mode via `--no-llm`.

Do I need an LLM API key to use it?

No. Static analysis (71 vulnerability patterns, YARA signatures, AST checks) runs without any LLM. An LLM key or local model (OpenAI, Anthropic, Bedrock, Ollama, and others) is only needed for the optional semantic analysis stage.

Can SkillSpector run inside CI/CD pipelines?

Yes. It outputs SARIF reports designed for CI/CD and IDE tooling, and a risk score (0-100) that can gate pipeline steps or pull request checks.

How does it integrate with agents like Claude Code or Codex CLI?

SkillSpector can run as a Model Context Protocol (MCP) server (`skillspector mcp`), letting MCP-capable agents call scanning as a tool and gate skill or MCP installs directly on the scan result.

What happens with false positives?

You can suppress known or accepted findings using a baseline file, either with drift-tolerant glob rules or exact fingerprints, so subsequent scans and risk scores only reflect new, untriaged findings.

SkillSpector: Static and LLM-based scanner

SkillSpector is a security scanner built for the emerging world of AI agent skills, the packaged capabilities used by Claude Code, Codex CLI, Gemini CLI, and similar tools. It's aimed at developers, security teams, and anyone maintaining a catalog of third-party agent skills who needs to vet them before letting an agent execute them. NVIDIA built it as part of its Verified Skills pipeline, which scans, evaluates, and signs skills before they're published to the NVIDIA skills catalog.

The core problem it addresses: agent skills run with implicit trust and little vetting. According to the project's own research dataset of over 31,000 skills, about 26% contain vulnerabilities and 5% show signs of malicious intent. SkillSpector gives you a concrete answer to "is this skill safe to install?" instead of guessing.

Key features

Multi-format input: scan Git repos, URLs, zip files, directories, or single files without converting formats first.
71 vulnerability patterns across 17 categories: covers prompt injection, data exfiltration, privilege escalation, supply chain risk, excessive agency, system prompt leakage, memory poisoning, tool misuse, rogue agent behavior, anti-refusal tricks, trigger abuse, dangerous code via AST analysis, taint tracking, YARA signatures, and MCP-specific checks like least privilege and tool poisoning.
Two-stage analysis: fast static checks run by default, with an optional LLM pass for semantic evaluation when static rules aren't enough.
Live CVE lookups: SC4 checks OSV.dev for real-time vulnerability data, falling back to an offline dataset if the network call fails.
Multiple report formats: terminal, JSON, Markdown, and SARIF (for CI/CD and IDE integration).
Risk scoring: a 0-100 score with severity labels and clear recommendations, not just a raw findings dump.
Baseline suppression: accept known or false-positive findings via glob rules or exact fingerprints, so re-scans only surface genuinely new issues.
MCP server mode: runs as a Model Context Protocol server so agents like Claude Code or Codex CLI can call scanning as a tool and gate installs on the result.
Resource bounds: enforces caps on ingest size, zip member count, and per-file analysis size to fail closed against oversized downloads or zip bombs.

Ideal use cases

SkillSpector fits teams or individuals who install third-party agent skills, MCP servers, or Claude/Codex/Gemini extensions and want a pre-install security gate. It's a good fit for CI/CD pipelines that need to block untrusted skills via SARIF output, for maintainers running a skill catalog who want batch scanning across hundreds of skills, and for anyone wiring scan results directly into an agent session through the MCP server so installs get gated automatically.

It's less useful if you only consume skills from a single, fully trusted, internally-authored source where supply-chain risk is effectively zero. It's also not a general-purpose static analysis tool for arbitrary Python or JavaScript codebases; its rule set and scoring are specific to agent-skill risks like prompt injection and tool misuse, not generic app security. And while the LLM analysis stage adds semantic depth, it depends on an external or local LLM provider, so fully offline deployments are limited to the static-only (--no-llm) mode.

Installation

SkillSpector requires Python 3.12+. The quickest path is a CLI-only install via uv:

uv tool install git+https://github.com/NVIDIA/skillspector.git
# Update later: uv tool update skillspector

If you need the MCP server (skillspector mcp), install the extra:

uv tool install 'skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git'

To install from source instead:

git clone https://github.com/NVIDIA/skillspector.git
cd skillspector

uv venv .venv && source .venv/bin/activate
# or: python3 -m venv .venv && source .venv/bin/activate

make install
# or for development: make install-dev

Docker is also supported if you'd rather not install Python locally:

make docker-build
# or: docker build -t skillspector .

docker run --rm -v "$PWD:/scan" skillspector scan ./my-skill/ --no-llm

Once installed, run a basic scan:

skillspector scan ./my-skill/
skillspector scan https://github.com/user/my-skill
skillspector scan ./my-skill.zip

Add --format json --output report.json (or markdown/sarif) to generate a report file, and --no-llm to skip the optional LLM semantic pass for faster, fully static scans.