Who SkillSpector is for#
Developers
Ensure the safety of third-party AI skills before integration.
Skip if:
Skip if only using trusted internal skills.
Security Analysts
Assess and report on the security posture of AI agent skills.
Skip if:
Skip if no AI skills are being evaluated.
The problem it solves#
The project helps solve the problem of identifying vulnerabilities and malicious patterns in AI agent skills before they are installed, ensuring user safety and security.
How it solves it#
Multi-format Input
Scan Git repos, URLs, zip files, directories, or single files.
64 Vulnerability Patterns
Detect vulnerabilities across 16 categories including prompt injection and data exfiltration.
Two-stage Analysis
Combine fast static analysis with optional LLM semantic evaluation.
Live Vulnerability Lookups
Query OSV.dev for real-time CVE data with automatic offline fallback.
Multiple Output Formats
Generate reports in Terminal, JSON, Markdown, and SARIF formats.
Risk Scoring
Provides a score from 0-100 with severity labels and recommendations.
Strengths and trade-offs#
Strengths
- Comprehensive DetectionIdentifies a wide range of vulnerabilities across various categories.
- Real-time DataUtilizes live vulnerability lookups for up-to-date security information.
- Flexible UsageSupports multiple input formats and output report types.
- User-friendlyProvides clear recommendations based on risk scoring.
Trade-offs
- -Static Analysis LimitationsStatic analysis may miss vulnerabilities that only manifest during runtime.
- -Language SupportMay not effectively analyze non-English content.
- -Image-based AttacksCannot analyze text in images or encrypted/binary code.
Install and self-host#
git clone https://github.com/NVIDIA/skillspector.gitWhat it's built on#
- Languages
- Python
FAQ#
What types of files can SkillSpector scan?
SkillSpector can scan Git repositories, URLs, zip files, directories, and single files.
How does SkillSpector determine risk scores?
Risk scores are calculated based on the severity of detected vulnerabilities, with higher scores indicating greater risk.
Can I use SkillSpector without Python?
Yes, SkillSpector can be run using Docker without needing to install Python.
Similar open-source tools#
Local Deep Research
Your AI research assistant, fully local and encrypted.
ClawTrace
Visualize agent execution trees and track token costs per step
OpenFang
Open source Agent OS built in Rust with autonomous agents
ClawMetry
Real-time observability dashboard for AI coding agents
IronClaw
Open source security scanner for AI agent deployments
Hyprnote
Local-first AI meeting notetaker with transcription