Verified project record

NVIDIA/SkillSpector

SkillSpector performs static security analysis of AI agent skills from Git repos, URLs, archives, directories, or individual files to detect vulnerabilities and malicious patterns before installation. It offers optional LLM-based semantic evaluation, live OSV.dev vulnerability lookups, and 0-100 risk scoring.

Project overview

Agent skills are commonly installed and executed with implicit trust and minimal vetting; this project provides a pre-installation scanning workflow that targets that specific security gap using static analysis and optional remote LLM inference.

Project type: AI Agent · AI Coding
Use cases: Coding & Development
Deployment: Refer to project documentation
License: Apache-2.0

Best for

Developers, operations teams, and AI engineers who need to identify vulnerabilities, malicious patterns, and security risks in agent skills prior to installation.

Key capabilities

Performs static analysis on Git repositories, URLs, zip files, directories, or single files to detect vulnerabilities.
Provides an optional semantic evaluation layer for deeper analysis using OpenAI-compatible endpoints.
Queries OSV.dev for real-time CVE data and includes an automatic offline fallback mechanism.
Calculates a 0-100 risk score accompanied by severity labels and recommendations.
Allows users to accept known findings via a glob-rule or fingerprint baseline, ensuring that subsequent re-scans surface only new issues.
Scans entire directories of skills in parallel and includes multilingual detection support.

Limitations and risks

The tool may miss vulnerability patterns that exist in non-English content.
The tool cannot analyze text embedded in images, which may allow image-based attacks to go undetected.
The tool cannot analyze compiled or encrypted content.
The tool performs static analysis only and does not provide dynamic execution or runtime behavior analysis.
Without network access to api.osv.dev, the OSV.dev integration uses a small static fallback list instead of real-time CVE data.
The tool downloads and installs additional third-party open source software projects.

Getting started

Install via uv tool install git+https://github.com/NVIDIA/skillspector.git or pip, then execute a scan using a command such as skillspector scan ./my-skill/.

Alternatives and comparisons

Declarative testing and automated evaluations with vulnerability scanning and LLM red teaming for AI applications.
A unified AI gateway that provides guardrails, logging, and observability callbacks for LLM calls across multiple providers.
A requirement-driven AI gateway decision guide and educational handbook covering security and compliance selection criteria.

Project comparisons

Evidence and sources

Open original GitHub project