NVIDIA/SkillSpector

Worth a look if you install third-party agent skills or maintain a catalog of them; treat it as one check in your vetting process, not a guarantee. The scanner is from NVIDIA, and its own research counts are a useful framing for why the check exists.

The problem

Skills for Claude Code, Codex CLI, Gemini CLI and similar agents are often installed from a URL, a zip or a stranger's repository, and they run with whatever access the agent already has. Before installing, you want a quick answer to whether the skill hides prompt injection, tries to exfiltrate data, or pulls in a vulnerable dependency. The usual alternative is skimming SKILL.md by hand and hoping you notice the odd instruction buried in a script. SkillSpector changes that step: point it at a directory, a single file, a zip, a Git URL or a repository, and you get a risk score plus findings to read before adding the skill to your setup.

What's different

The design is a two-stage pipeline: fast static analysis runs first, and an optional LLM semantic pass follows. The static side covers 71 patterns across 17 categories, including AST checks on dangerous code, taint tracking, YARA signatures, MCP least-privilege and tool-poisoning rules, and a lookup against OSV.dev for live CVE data with an offline fallback. Output can be terminal, JSON, Markdown or SARIF, so a finding can go straight into a code-scanning interface rather than living only in a chat log. A baseline/suppression mechanism lets you accept known findings by glob rule or fingerprint, which makes re-scans useful when you track many skills: only new issues surface.

The important trade-off is that this is static analysis only. There is no dynamic execution, so behavior that only appears at runtime is out of reach. The README also says non-English content and text inside images may be missed, and compiled or encrypted code cannot be analyzed. The optional LLM pass adds judgment but is not a separate dynamic check; one commenter on Hacker News argued that an LLM reviewing LLM-targeted prompts is weak defense because the same trick that fools the executing model may fool the reviewer comment by TZubiri, 2026-06-13. Another compared it to antivirus: better than nothing, but hard to know how much better comment by jacobgold, 2026-06-13. A third saw it as a reasonable layer inside a broader supply-chain plan comment by DonsDiscountGas, 2026-06-13. Those are opinions, not findings about this tool.

Who should try it

Good fit: a developer or platform team that already consumes skills from public sources and wants a repeatable pre-install check, especially with SARIF output or baseline suppression for ongoing triage. It is also relevant if you maintain a skills catalog and need a gate before publication; NVIDIA describes it as part of a scan, evaluate and sign pipeline for its own catalog.

Poor fit: anyone expecting a runtime sandbox or proof that a skill is harmless. If your skills only run in a trusted internal repository with reviewed authors, the added step may not tell you much you do not already know. Teams that cannot upgrade to Python 3.12 have no supported path here, and the MCP server mode requires installing the MCP extra separately if you use the uv tool install route. The hosted scanning guide is the place to check expected workflow and how to read a report scanning guide.

Requirements and limitations

Python 3.12+ is required. Installation is either a uv tool install from the Git URL or a source checkout with a virtual environment and the project Makefile; install the MCP extra at install time if you plan to run the MCP server. The README warns that the project downloads additional third-party open-source software, so dependency review is part of setup.

Ongoing upkeep matters more than first install: re-run scans as skills change, and maintain the baseline deliberately so suppressed findings do not become a blind spot. Offline SC4 lookups fall back to a small static list, so air-gapped use gives weaker vulnerability data. Resource ceilings exist for bundles, parsers, nested artifacts and findings, documented separately analysis resource bounds; very large or oddly structured bundles may hit those limits rather than produce a full report. Development and extension notes are in the repo development guide.

HotRepo's take

HotRepo has one daily-board observation: 21,678 stars on 2026-10-26, +203 that day, on the daily board. That is a single dated snapshot, so persistence cannot be judged. The project is young, created 2026-03-21, which fits the sparse history.

Adoption judgement: worth trying as a pre-install static check if you already treat skills as untrusted code, but do not treat a clean report as permission to run anything. Before relying on it, read the scanning guide's explanation of how to interpret a report and decide what threshold, if any, should block an install in your workflow project instructions.