SkillSpector CLI
Security scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
- 25,545 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- Clones repositories and unpacks archives to disk for analysis
- Reaches the network: OSV.dev for CVE data and, optionally, an LLM provider
Install
- Works in
Manual install
uv tool install git+https://github.com/NVIDIA/skillspector.gitCLI-only install. Update with uv tool update skillspector. Source install via make install and a Docker run without Python are also available.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Clones repositories and unpacks archives to disk for analysis
- Reaches the network: OSV.dev for CVE data and, optionally, an LLM provider
This is third-party code. Review the repository files before installing.
What it does
SkillSpector vets skills and MCP servers before you install them. Input can be a git repo, a URL, a zip archive, a directory or a single SKILL.md file. Static analysis matches content against 71 vulnerability patterns across 17 categories: prompt injection, data exfiltration, privilege escalation, supply chain, dangerous code via AST parsing, MCP tool poisoning and others. An optional LLM stage adds semantic evaluation, and rule SC4 checks dependencies against live OSV.dev CVE data with an automatic offline fallback. The output is a 0 to 100 risk score with a severity label and a clear recommendation, plus reports in terminal, JSON, Markdown or SARIF for CI. It also runs as an MCP server so an agent can gate installs on the scan result.
Who it is for. For developers and security engineers who install third-party skills, MCP servers and plugins and want to vet them first.
Good fit when
- Before installing a skill, plugin or MCP server from an unfamiliar source
- To add a skill scan gate to CI over a repository or a directory
- To run scanning from inside an agent session via the MCP server or the OpenCode and Pi extensions
Not a fit when
- You need a review of ordinary application code rather than agent skills
- You need a safety guarantee rather than a risk signal: heuristics produce both false positives and misses
Example request
Check this skill for safety before I install it: https://github.com/user/some-skillLimitations
Analysis is heuristic, so both false positives and misses are possible; accepted findings are suppressed via a baseline. The LLM stage is optional and needs an OpenAI-compatible endpoint with its own key or a local model; without it only static analysis runs. It requires Python 3.12+ or Docker. Input size is capped: 100 MiB per source, 10000 zip members, 1 MB per analyzed file. The MCP server's HTTP transport ships without authentication and should only be exposed behind a reverse proxy. Some LLM providers such as OpenAI and Anthropic are unreachable from Russia without a VPN, but the static mode and local models work offline.
How to disable. Uninstall the tool: uv tool uninstall skillspector, or remove the virtual environment or pip package. If you registered it as an MCP server, remove it: claude mcp remove skillspector.
FAQ
Do I need an LLM key?
No. Static analysis runs without a key, and the --no-llm flag turns off the semantic stage. It is optional and needs an OpenAI-compatible endpoint or a local model.
Can it run in CI?
Yes. The SARIF format targets CI/CD and IDE tooling, JSON and Markdown are also available, and batch scanning walks a skill directory in parallel.
How is SkillSpector different from manually checking a skill before install?
The tool accepts a git repository, a link, a zip, a directory or a SKILL.md file and checks the content against 71 patterns: prompt injection, data leaks and supply chain risks. The check runs before installation.
What is SkillSpector and how do I install it on Windows?
It is a security scanner from NVIDIA for skills and MCP servers. Install with uv tool install git+https://github.com/NVIDIA/skillspector.git. Windows needs uv, check the project README for platform details.
Discussion
No questions or reviews yet.
Related
CLI toolsA security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
The SkillHawk static scanner finds dangerous instructions in SKILL.md, MCP configs and AGENTS.md and runs as a GitHub Action
A Snyk CLI that discovers installed MCP servers, skills and agents on your machine and checks them for prompt injections and malicious payloads
Security scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
A security scanner for MCP servers and agent skills that looks for prompt injection, secret leaks and swaps after approval.
ClawScan runs several security scanners on agent skills and hands their results to a judge for a combined verdict.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| SkillSpector (this card) | no | 25,545 | |
| SkillMD | no | 144 | CLI and MCP tools for finding and installing skills, with SKILL.md linting and flags for network use, scripts and secrets |
| Agentic Radar | yes | 1,069 | agentic Radar analyzes multi-agent code on LangGraph |
| AgentSeal | no | 383 | a CLI that scans your machine for skills and MCP configs |
README in short
The README presents SkillSpector as a security scanner for agent skills and MCP servers, which are usually installed with implicit trust. It scans repositories, URLs, archives, directories and single files, using static analysis with 71 vulnerability patterns and an optional LLM evaluation. It installs via uv, pip or source, or runs in Docker with no Python setup, and reports to terminal, JSON, Markdown and SARIF. The MCP server mode and the OpenCode and Pi extensions let you gate installs from inside an agent. SkillSpector is part of the NVIDIA Verified Skills pipeline. Apache 2.0 licensed.