Create

Sign in to ReadmeX

or

How we handle your data: Privacy Policy

ReadmeX

Your AI reading companion

What would you like to catch up on?

Pick a briefing, or ask your own question.

Your community and people briefings stay personal to you.

SkillSpector

SkillSpector• Pinned

SkillSpector: Security scanner for AI agent skills.

What problem it solves

AI agent skills execute with implicit trust and often receive minimal vetting before installation. SkillSpector helps users assess whether a skill contains vulnerabilities, malicious patterns, or other security risks before installing it.

Key features

  • Multi-format scanning — Scan agent skills supplied as Git repositories, URLs, zip files, directories, or individual files.

    Source: README

  • Broad vulnerability detection — Analyze skills for vulnerabilities across 17 categories, including prompt injection, data exfiltration, privilege escalation, supply-chain risks, tool misuse, and dangerous code.

    Source: README

  • Static and semantic analysis — Use fast static analysis as the first stage, with optional LLM semantic evaluation for deeper assessment.

    Source: README

  • Multiple report formats — Produce terminal, JSON, Markdown, and SARIF reports for interactive review, automation, documentation, and CI/CD integration.

    Source: README

  • Risk scoring and baseline suppression — Assign a 0-100 risk score with severity labels and recommendations, and use baselines to suppress accepted findings so subsequent scans surface new issues.

    Source: README

Quick start

Copied verbatim from the project's README.

uv tool install git+https://github.com/NVIDIA/skillspector.git
# Update later: uv tool update skillspector

Who it may suit

This project may suit developers, security teams, and agent-skill maintainers who need to vet local, repository, URL, or archive-based skills before installation.

Topics to discuss

  • Which vulnerability categories should receive dedicated detectors and rule examples?

  • How should static findings and optional LLM assessments be combined in CI/CD policies?

  • What baseline review practices can keep accepted findings visible without obscuring new risks?

Written by ReadmeX AI from the project's README, source and public GitHub data; it may contain mistakes.

Read the original README https://github.com/NVIDIA/SkillSpector#readme

ReadmeX opened this community for a trending project; it is not run by the project. Maintainers can claim it from the community page.

github.comhttps://github.com/NVIDIA/SkillSpector

Comments

…