Installing an Agent Skill means handing your agent instructions and scripts you didn't write. SkillSpector, NVIDIA's scanner that vets skills before you install them, is past 22,000 GitHub stars and 1,900 forks, and version 2.13.1 shipped on October 23, 2026.
What SkillSpector is
A security analyzer for Claude Code, Codex and MCP skills. Point it at a folder, a SKILL.md, a zip file or a repo URL and it returns a 0–100 risk score with a verdict: SAFE (0–20), CAUTION (21–50) or DO NOT INSTALL (51–100). It is part of the pipeline NVIDIA uses to verify its own skills.
It works in two stages:
- Static analysis. Eleven analyzers with 71 patterns across 17 categories, including prompt injection, anti-refusal instructions, data exfiltration, privilege escalation, supply chain, excessive agency, memory poisoning, trigger abuse and MCP least privilege. On top of that it runs AST checks on scripts (
exec,eval,subprocess), taint tracking, YARA signatures and CVE lookups for dependencies on OSV.dev. - LLM review (optional). A model evaluates the findings and can confirm or explain them, but it can never drop a deterministic finding: anything it doesn't confirm is tagged
llm-unconfirmed.
The scoring is easy to reason about: a critical finding adds 50 points, high 25, medium 10 and low 5, with a 1.3x multiplier when the finding sits in an executable script. The skill itself is never run. It is written in Python 3.12+ and licensed Apache-2.0.
How to use it
Install it as a tool with uv, straight from the repo:
uv tool install git+https://github.com/NVIDIA/skillspector.git
# Local analysis only, no files sent to an LLM
skillspector scan ./my-skill/ --no-llm
# SARIF report for code scanning or your IDE
skillspector scan https://github.com/user/my-skill --format sarif --output report.sarifFor CI, the exit codes are what matter: 0 for SAFE or CAUTION, 1 when the risk is above 50 or a strict gate fires (--fail-on-findings, --fail-on-incomplete), and 2 on error. skillspector baseline lets you accept a skill's known findings so the pipeline only fails on new ones. There is also an MCP server exposing a single scan_skill tool, so the agent can check a skill before installing it:
claude mcp add skillspector -- skillspector mcpThe catch is in the defaults: LLM review is on, and in that mode the contents of the analyzed files go to whichever provider you configure (OpenAI, Anthropic, Bedrock, Gemini, NVIDIA Build, Ollama…). If the skill is internal, use --no-llm or a local Ollama. Even with --no-llm, dependency names and versions are sent to OSV.dev for the CVE check.
What I like and what I don't
I like that it takes its own security seriously. Version 2.13.0, from October 16, disabled the Codex CLI provider because its read-only sandbox could read host secrets, restricted MCP HTTP listeners to loopback, and added detection for encoded shell payloads that get decoded and executed. Not letting the LLM remove findings is also the right call: a prompt injection inside the skill can't talk the report into coming back clean.
The pace is fast (1,698 commits, PRs merged on October 22, 2026), and that has a cost: the 2.12.0 notes warn that findings, scores and baselines can change on upgrade. If you put it in CI, pin the version. There are 81 open issues.
The README is upfront about its limits: it can't read text inside images or analyze compiled or encrypted code, it may miss patterns in non-English content and, above all, it is not a sandbox. It flags the risk; it does not contain a skill you decide to install anyway.
SkillSpector vs Snyk Agent Scan
The best-known alternative is Snyk Agent Scan, the successor to mcp-scan, which also covers skills alongside agents and MCP servers.
| SkillSpector | Snyk Agent Scan | |
|---|---|---|
| Approach | Vets one skill before you install it | Inventories the agents, MCP servers and skills on a machine |
| Where analysis runs | Locally; the optional LLM is your choice | On Snyk's servers (skill content and tool descriptions, with secrets redacted) |
| Account | None needed | Requires SNYK_TOKEN |
| Runs code | Never runs the skill | Starts the stdio MCP servers in your config to read their tools (asks for consent) |
| CI output | JSON, SARIF 2.1.0 and exit codes | CLI report and background mode reporting to Snyk |
| License and traction | Apache-2.0, 22.1k stars | Apache-2.0, 3.2k stars |
When to use which: SkillSpector fits as a gate, in the pipeline that decides which skills make it into the repo or the team, and when you don't want skill content leaving your network. Snyk Agent Scan makes more sense for auditing what is already installed on your team's laptops, MCP servers especially, if you already use Snyk.
Sources
- NVIDIA/SkillSpector, GitHub.
- SkillSpector releases, GitHub, October 23, 2026.
- snyk/agent-scan, GitHub.