Open Source Alternatives
  • Alternatives
  • Categories
    Categories by size1,039 projects
    • Developer Tools530
    • AI & Machine Learning459
    • Business & Productivity241
    • Web Development204
    • Security & Monitoring155
    • Communication & Collaboration140
    • IT Management137
    • Cloud & Hosting122
    • LLMOps & AI Tooling120
    • Data & Analytics112
    Browse all 21 categoriesDesign & Creative, Product & Project Management and 9 more
  • Blog
  • Advertise
SearchNotion, Slack, password manager.../
Submit
Open Source Alternatives
  • Alternatives
    • Developer Tools530
    • AI & Machine Learning459
    • Business & Productivity241
    • Web Development204
    • Security & Monitoring155
    • Communication & Collaboration140
    • Browse all 21 categories
  • Blog
  • Advertise
Submit your project

New open source projects by email

The projects we add and every new guide. Free, unsubscribe any time.

Open Source Alternatives LogoOpen Source Alternatives

Handpicked Open Source Alternatives to Paid Softwares

Product

  • Categories
  • Tag
  • Advertise

Resources

  • Blog
  • Collection
  • Submit

Company

  • Privacy Policy
  • Terms of Service
  • Refund Policy
  • Sitemap

Alternatives

  • Claude Code
  • Jira
  • Notion
  • Slack
  • Linear
  • Wispr Flow
  • All alternatives
© 2026 Open Source Alternatives. All rights reserved.
Open SourceAlternatives
Home/Categories/Security & Monitoring/SkillSpector
icon of SkillSpector

SkillSpector

Open source alternative to Lasso Security

  • 23.9K stars
  • Apache-2.0
  • Active this week
  • Last commit 2 days ago

Last verified Nov 2, 2026

Secure AI agent skills before installation with static and optional LLM analysis for prompt injection, exfiltration, and supply-chain risks.

Visit websiteGitHub23.9K stars
image of SkillSpector
TL;DR

SkillSpector is a security scanner for AI agent skills that detects vulnerabilities and malicious patterns. It provides a two-stage analysis with live vulnerability lookups and multiple output formats. This tool helps ensure that AI skills are safe to install and use.

Read the full breakdownHide the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ
who it's for

Who SkillSpector is for#

Developers

Ensure the safety of third-party AI skills before integration.

Skip if:

Skip if only using trusted internal skills.

Security Analysts

Assess and report on the security posture of AI agent skills.

Skip if:

Skip if no AI skills are being evaluated.

the problem

The problem it solves#

The project helps solve the problem of identifying vulnerabilities and malicious patterns in AI agent skills before they are installed, ensuring user safety and security.

how SkillSpector solves it

How it solves it#

Multi-format Input

Scan Git repos, URLs, zip files, directories, or single files.

64 Vulnerability Patterns

Detect vulnerabilities across 16 categories including prompt injection and data exfiltration.

Two-stage Analysis

Combine fast static analysis with optional LLM semantic evaluation.

Live Vulnerability Lookups

Query OSV.dev for real-time CVE data with automatic offline fallback.

Multiple Output Formats

Generate reports in Terminal, JSON, Markdown, and SARIF formats.

Risk Scoring

Provides a score from 0-100 with severity labels and recommendations.

strengths · trade-offs

Strengths and trade-offs#

Strengths

  • Comprehensive DetectionIdentifies a wide range of vulnerabilities across various categories.
  • Real-time DataUtilizes live vulnerability lookups for up-to-date security information.
  • Flexible UsageSupports multiple input formats and output report types.
  • User-friendlyProvides clear recommendations based on risk scoring.

Trade-offs

  • -Static Analysis LimitationsStatic analysis may miss vulnerabilities that only manifest during runtime.
  • -Language SupportMay not effectively analyze non-English content.
  • -Image-based AttacksCannot analyze text in images or encrypted/binary code.
versus alternatives

SkillSpector vs alternatives#

SkillSpector vs Snyk Code

SkillSpector and Snyk Code both scan for security risk, but they target different surfaces. SkillSpector focuses on AI agent skills before installation; Snyk Code focuses on application source code security across developer workflows.

FeatureSkillSpectorSnyk Code
LicenseApache-2.0Proprietary service with free and paid plans
Primary targetAI agent skills, skill repositories, zip files, directories, and individual skill filesApplication source code in IDEs, repositories, and CI/CD workflows
Analysis styleStatic checks plus optional LLM semantic analysisSAST scanning with prioritization and automated fix guidance
Vulnerability dataUses OSV lookups for live CVE data with offline fallbackUses Snyk's managed code security engine and workflow integrations

Choose SkillSpector when the risk is installing an agent skill that may contain prompt injection, data exfiltration, excessive agency, MCP tool abuse, or other agent-specific behavior. Its scanner understands the skill format and reports risk in terminal, JSON, Markdown, and SARIF formats.

Choose Snyk Code when the goal is broader application security scanning across a development team. It fits IDE, repository, and pull request workflows better than a skill-specific scanner. SkillSpector is the focused pre-installation check for agent skills; Snyk Code is the managed SAST workflow for application code.

install · quick start

Quick start#

bash
# Local Python install
git clone https://github.com/NVIDIA/skillspector.git
cd skillspector
uv venv .venv && source .venv/bin/activate
make install

# Docker self-hosted scan
make docker-build
docker run --rm -v "$PWD:/scan" skillspector scan ./my-skill/ --no-llm
tech stack · detected from GitHub

What it's built on#

Languages
PythonTypeScript
Infrastructure
AWS
frequently asked

FAQ#

What types of files can SkillSpector scan?

SkillSpector can scan Git repositories, URLs, zip files, directories, and single files.

How does SkillSpector determine risk scores?

Risk scores are calculated based on the severity of detected vulnerabilities, with higher scores indicating greater risk.

Can I use SkillSpector without Python?

Yes, SkillSpector can be run using Docker without needing to install Python.

also worth a look

Similar open-source tools#

REA (Reverse Engineer Anything)

Featured

Alternative toRevEng.AI

AI-powered reverse engineering for binaries, apps, and assemblies.

  • 418,752 GitHub stars
  • MITLicence MIT

Sandchest

Alternative toSnyk

AI code security reviewer using abliterated, unrestricted models

  • 50 GitHub stars
  • AGPL-3.0Licence AGPL-3.0

Nasiko

Alternative toPortkey

Self-hosted runtime for agent cost control, routing, and access policy

  • 11,681 GitHub stars
  • Apache-2.0Licence Apache-2.0

AiSOC

Alternative toPalo Alto Networks Cortex XSIAM

Self-hostable AI SOC with auditable agent decisions and MIT license

  • 6,228 GitHub stars
  • MITLicence MIT

Oya Browser

Alternative toBrowserbase

Records portal tasks once; replays with no model and no bot detection

  • 349 GitHub stars
  • CustomLicence Sustainable Use License 1.0

Agent Security

Alternative toLakera Guard

On-device policy enforcement and secret detection for AI coding agents

  • 228 GitHub stars
  • Apache-2.0Licence Apache-2.0
by category

Open source tools in these categories#

155

Security & Monitoring

REA (Reverse Engineer Anything), RustDesk, Uptime Kuma459

AI & Machine Learning

freeCodeCamp, REA (Reverse Engineer Anything), OpenClaw

Sponsors

Inbox Zero

Alternative toSuperhuman

AI email assistant that drafts replies and clears your inbox

  • 12,889 GitHub stars
  • AGPL-3.0Licence AGPL-3.0
  • #Email

rakazo

Alternative toGrok Bot

AI teammates you own: your keys, your model, your machine.

  • 6,568 GitHub stars
  • Apache-2.0Licence Apache-2.0
  • #AI Agents

SnitchFeed

Live monitoring on LinkedIn, X, Reddit & more. Agentic social listening for startups.

Marketing & Growth

Advertise your product

New open source projects by email

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

/
  • Claude Code to OpenCode
  • Jira to Windshift
  • Notion to AppFlowy
  • Slack to Mattermost
  • Linear to GitLab
  • Wispr Flow to Handy
  • Arc to Zen Browser
  • CapCut to Concat
  • Grok Bot to rakazo
  • Superhuman to Inbox Zero
  • Airtable to AITable
  • Muse to OpenClaw
  • Railway to Coolify
  • GitHub Copilot to Cline
  • Datadog to Netdata
  • Microsoft Teams to Rocket.Chat
  • Confluence to Docmost
  • Pinecone to Qdrant
  • Zapier to n8n
  • Devin AI to OpenHands
  • Firebase to Supabase
  • 1Password to KeePassXC
  • Contentful to Strapi
  • Adobe Premiere Pro to Shotcut
  • Claude Code to OpenCode
  • Jira to Windshift
  • Notion to AppFlowy
  • Slack to Mattermost
  • Linear to GitLab
  • Wispr Flow to Handy
  • Arc to Zen Browser
  • CapCut to Concat
  • Grok Bot to rakazo
  • Superhuman to Inbox Zero
  • Airtable to AITable
  • Muse to OpenClaw
  • Railway to Coolify
  • GitHub Copilot to Cline
  • Datadog to Netdata
  • Microsoft Teams to Rocket.Chat
  • Confluence to Docmost
  • Pinecone to Qdrant
  • Zapier to n8n
  • Devin AI to OpenHands
  • Firebase to Supabase
  • 1Password to KeePassXC
  • Contentful to Strapi
  • Adobe Premiere Pro to Shotcut