What is SkillSpector?
SkillSpector is NVIDIA's open-source security scanner for the agent skills used by Claude Code, Codex CLI, Gemini CLI and MCP clients. Point it at a Git repository, URL, zip, directory or single SKILL.md and it returns a 0 to 100 risk score, a severity and one of three recommendations: SAFE, CAUTION or DO NOT INSTALL. It is also the security tier of NVIDIA's Verified Skills pipeline, which scans and signs skills before they are published to NVIDIA's skills catalogue.
Detection runs in two stages. Static analysis covers 71 patterns in 17 categories using regex rules, Python AST checks, taint tracking, YARA signatures and live CVE lookups against OSV.dev. An optional LLM stage then reviews the findings for context and intent; it can raise a finding's confidence but never removes one. LLM analysis is on by default and defaults to Z.ai's GLM-5.3 on NVIDIA's build.nvidia.com, with OpenAI, Anthropic, Bedrock, Gemini, Azure OpenAI, Ollama and local Claude or Gemini CLIs as alternatives.
The repository was created in March 2026, is Apache 2.0-licensed and has about 23,700 GitHub stars and 2,046 forks. It is not on PyPI: it installs from GitHub with uv or as a locally built Docker image, and needs Python 3.12 or later. v2.13.2 shipped on 28 October 2026, one of 20 GitHub releases since July 2026, and the package is still classified as Alpha.
Is SkillSpector worth it?
SkillSpector is the most thorough of the open skill scanners we cover, and its strength is depth rather than reach. Snyk Agent Scan sweeps a whole machine for installed MCP servers and skills; SkillSpector takes one skill and reads it closely, across 71 patterns in 17 categories, from hidden instructions and whitespace padding to reflective getattr calls, credentials flowing to network sinks and redirected package sources. It never runs the skill. That alone separates it from Agent Scan, which starts stdio MCP servers in order to read their tool descriptions.
The method is deliberately layered. Eleven static analyzers, Python AST checks, YARA rules and OSV.dev lookups do the first pass, which the README describes as high recall with moderate precision. The LLM stage then confirms or disputes each finding, but it cannot delete one: confirmed findings gain confidence, and the rest stay in the report tagged llm-unconfirmed. A noisy regex hit therefore still counts towards the score. The prompt carries anti-jailbreak protections against skills written to steer the judge. By default the judge is GLM-5.3 on build.nvidia.com at high reasoning effort; on Anthropic it is claude-opus-4-6, and on Ollama a local llama3.1:8b keeps the files on your machine.
What NVIDIA does not publish is a hit rate. Cisco's Skill Scanner reports its own held-out results, including that rules alone block 7.7% of malicious skills; SkillSpector cites only the research behind it, in which 26.1% of 31,132 analysed skills had a vulnerability and 5.2% showed likely malicious intent. That measures the problem, not the scanner. False positives are acknowledged in the design, through baseline files that suppress accepted findings, and in the tracker, where issue #887 reports an aircraft-safety explanation flagged as harmful instructions. The README's own list of blind spots covers non-English text, text in images, compiled or encrypted code and runtime behaviour.
It is built for CI. SARIF 2.1.0 output feeds code scanning, and the scan exits with 1 when the score passes 50. The default lets a CAUTION result (21 to 50) through, so a strict gate needs --fail-on-findings, --fail-on-incomplete or --min-coverage. An MCP server mode gives an agent a scan_skill tool to check skills before installing them; its HTTP transport has no authentication and binds only to loopback. The pace is high, with 20 releases since July 2026 and 136 open issues and pull requests.
Against the two scanners already on this site, the trade is plain. Snyk's is the better inventory of what is installed, Cisco's is more candid about how much it catches, and SkillSpector reads a single skill most closely, with no vendor account and, if you choose, no model at all.
Where it earns its place
A platform team keeping 40 internal Claude Code skills in one repository
Block a merge when a skill change adds exfiltration or hidden instructions
Run skillspector scan ./skills --recursive --max-skills 50 --no-llm --format sarif --fail-on-findings in CI, since the default cap is 32 skills, and upload the SARIF to code scanning. Commit a baseline for accepted findings so only new ones fail the build; static scans keep file contents on the runner, though OSV.dev still receives dependency names.
A security engineer approving a marketplace skill for a 200-person engineering org
Decide whether a third-party skill is safe to install company-wide
Scan the GitHub URL with LLM analysis routed through the company's Bedrock or Azure OpenAI account, so contents stay under existing data terms, then read the recommendation band and the llm-unconfirmed tags rather than the score alone. The cost is model tokens, which the JSON report records per call.
A developer on Claude Code who adds community skills most weeks
Have the agent check a skill before it installs it
Install with the mcp extra and register it with claude mcp add skillspector -- skillspector mcp; the agent calls scan_skill and gets safe_to_install plus a flag saying whether the scan was static-only. Free; keep to stdio, because the HTTP transport has no authentication.
Before you commit
- Setup
- uv tool install git+https://github.com/NVIDIA/skillspector.git on Python 3.12+, or build the bundled Dockerfile; --no-llm gives a static scan with no keys at all. LLM analysis needs SKILLSPECTOR_PROVIDER and that provider's credentials.
- Integrations
- Terminal, JSON, Markdown and SARIF 2.1.0 output; an MCP server over stdio or loopback HTTP; Pi and OpenCode extensions; a Python API over its LangGraph workflow; 12 usable LLM providers, including Ollama, Bedrock, Azure OpenAI and the local Claude and Gemini CLIs.
- Data and privacy
- LLM analysis, on by default, sends analyzer-eligible file contents to the configured provider; --no-llm keeps them local. The SC4 check sends dependency names and versions to OSV.dev even in static mode. Reports are written with 0600 permissions. Apache 2.0.
- Cost at scale
- No paid edition. Static scans cost CI minutes; LLM scans cost provider tokens per skill, recorded per call in the JSON report. The default deadline for one scan is 18 minutes.
- Limits
- No published accuracy figures; 136 open issues and pull requests; non-English text, images, compiled code and runtime behaviour are out of reach; recursive scans stop at 32 skills by default; NVIDIA's docs page still says 68 patterns against the README's 71.
What’s good
- Never executes the skill it scans
- 71 patterns with AST, taint tracking, YARA and OSV.dev lookups
- SARIF output and documented exit codes for CI gates
- LLM stage can use a local Ollama model, or be skipped
What’s not
- LLM analysis is on by default and sends file contents to the provider
- No published detection or false-positive rates
- Not on PyPI; installs from GitHub and needs Python 3.12+
- Default exit code lets CAUTION results pass
Best for
Teams that install or publish agent skills and want a static gate in CI, with an optional model review, without signing up to a security vendor.
SkillSpector alternatives
SkillSpector: common questions
- Is SkillSpector worth it?
- The skill scanner to put in front of your installs, provided you remember that its LLM stage sends the skill's files to build.nvidia.com unless you change the provider or pass --no-llm. We rate it 4.1 out of 5.
- How much does SkillSpector cost?
- Free and open source under Apache 2.0. LLM analysis runs on your own provider account (build.nvidia.com by default) or a local model through Ollama.
- What are the downsides of SkillSpector?
- LLM analysis is on by default and sends file contents to the provider; no published detection or false-positive rates; not on PyPI; installs from GitHub and needs Python 3.12+; default exit code lets CAUTION results pass.
- Who is SkillSpector best for?
- Teams that install or publish agent skills and want a static gate in CI, with an optional model review, without signing up to a security vendor.
- How much does SkillSpector cost for a team or in production?
- No paid edition. Static scans cost CI minutes; LLM scans cost provider tokens per skill, recorded per call in the JSON report. The default deadline for one scan is 18 minutes.
- Is SkillSpector safe for company data?
- LLM analysis, on by default, sends analyzer-eligible file contents to the configured provider; --no-llm keeps them local. The SC4 check sends dependency names and versions to OSV.dev even in static mode. Reports are written with 0600 permissions. Apache 2.0.
- What are the best SkillSpector alternatives?
- The closest alternatives we have reviewed are Snyk Agent Scan, Cisco Skill Scanner and CC Safety Net.
Answers checked Oct 31, 2026.
Make SkillSpector? Show this rating on your site
