SkillSpector

Agent skills are code you download from strangers and hand to an AI that has access to your machine. SkillSpector scans them before you do that. It checks Git repos, URLs, zip files, and local directories against 68 vulnerability patterns across 17 categories, covering prompt injection, data exfiltration, and supply-chain risk, then returns a 0-100 risk score with an install recommendation. Apache 2.0, from NVIDIA, no paid tier.

Install is a Python 3.12 environment through uv, from source, or Docker if you would rather not touch Python at all. Static analysis needs no API key. The optional second stage sends the skill to an LLM for semantic review, which is where you supply your own provider key and pay that provider's rates. Output comes as terminal, JSON, Markdown, or SARIF, so it drops into CI without much glue.

Free for everyone, and worth wiring into CI if your team installs skills from public repos. Baseline suppression keeps accepted findings from re-firing on every run.

The catch is how you read the output. NVIDIA's own README reports vulnerabilities in 26.1% of skills scanned and likely malicious intent in 5.2%, which is a claim from the people selling the scanner, not an independent audit. Pattern matching also cannot prove safety. A clean scan means nothing known was found, not that a skill is safe to trust.