Primary question: Is this skill safe to install?
RepoDaily adoption score
RepoDaily rates this as 91/100 (strong) for adoption: evidence, installation path, production risk, differentiation, license clarity, and AI/agent fit are scored from the article sources and adoption notes.
5 source(s) across 5 source category/categories, plus a RepoDaily-specific evidence module when available.
6 workflow step(s), 5 next-action step(s), and 3 command/install signal(s) were detected.
Trending momentum is +410 stars, with maintenance/release/issue signals counted when present.
Risk is marked low, with 5 security note(s) and 3 explicit skip condition(s).
3 opportunity lens item(s), 3 alternative(s), and 0 type-specific section(s) support differentiation.
License source or license wording is present.
8 AI/agent-related signal(s) were detected in the article text and metadata.
Project overview
AI agent skills used by tools like Claude Code, Codex CLI, and Gemini CLI execute with implicit trust and minimal vetting. NVIDIA's own research shows that 26.1% of skills contain vulnerabilities and 5.2% show likely malicious intent. SkillSpector is a Python-based scanner that inspects skills before installation, surfacing prompt injection, data exfiltration, privilege escalation, supply-chain risks, and more.
The tool runs a two-stage pipeline: fast static pattern matching across 68 vulnerability patterns in 17 categories, followed by an optional LLM-based semantic evaluation. It accepts Git repos, URLs, zip files, directories, or single SKILL.md files, and outputs reports in Terminal, JSON, Markdown, or SARIF format with a 0–100 risk score.
Beyond one-off CLI scans, SkillSpector ships as an MCP server, letting any MCP-capable agent call scanning as a tool and gate skill or MCP installs on the result. This turns it from an out-of-band audit step into a runtime guardrail.
Why it is trending now
- Addresses a real and growing attack surface: agent skills from Claude Code, Codex CLI, and Gemini CLI run with implicit trust
- Backed by NVIDIA research showing over a quarter of skills contain vulnerabilities and roughly 1 in 20 show likely malicious intent
- MCP server mode enables install-time gating directly inside agent sessions, not just offline audits
- Broad coverage of 68 patterns across 17 categories including prompt injection, MCP tool poisoning, and taint tracking
- Apache-2.0 licensed with Docker support and no Python required for static scans
Problem it solves
- Agent skills are typically installed and executed without security review
- Skills can contain prompt injection, data exfiltration, privilege escalation, and supply-chain attacks
- Static code analysis alone misses semantic threats like rogue agent behavior or trigger abuse
- Existing security tools are not tuned for the skill and MCP-server threat model
- CI/CD and IDE pipelines lack a standard format for skill-scan results
How it works
- Provide a target: a Git repo URL, local directory, zip file, or a single SKILL.md file.
- SkillSpector runs static analysis with 68 patterns across 17 categories including AST-based dangerous-code detection, YARA signatures, and taint tracking.
- Optionally, an LLM provider performs a second-pass semantic evaluation for deeper context-aware findings.
- The SC4 stage queries OSV.dev for live CVE data with automatic offline fallback.
- A 0–100 risk score with severity labels and a recommendation is produced; results can be exported as JSON, Markdown, SARIF, or terminal output.
- Optionally, run the MCP server so any MCP-capable agent can call scan_skill and gate installs on the verdict.
Self-hosted App
SkillSpector is a locally hosted CLI and MCP server. It can be installed via uv without cloning the repo, built from source with the included Makefile, or run inside Docker with no Python on the host. Static-only scans (--no-llm) require no external API keys, making it suitable for air-gapped environments.
For teams that want semantic analysis, SkillSpector supports OpenAI, Anthropic, NVIDIA Build, Anthropic Vertex-style proxies, and any OpenAI-compatible local endpoint such as Ollama or vLLM. Credentials are passed via environment variables or a .env file, and the tool also works as a Pi extension for scanning skills from inside agent sessions.
Security Scanner Architecture: Skill Review Before Agent Execution
SkillSpector should be treated as a security tool for AI-agent skill files, not as a generic self-hosted app. The adoption path should inspect `README.md`, `pyproject.toml`, `CONTRIBUTING.md`, and `LICENSE`, then run the scanner against a known-safe skill pack and a deliberately suspicious test skill.
The concrete value is pre-execution review: teams need to know whether a skill can request dangerous shell commands, exfiltrate secrets, weaken sandbox rules, or hide unsafe instructions in Markdown. That means scanner output should be saved with exact command, version, path scanned, and false-positive notes.
Who should pay attention?
Good fit if
- Your team installs third-party agent skills or MCP servers from public sources
- You use Claude Code, Codex CLI, Gemini CLI, or similar MCP-capable agents in production
- You need SARIF output for CI/CD or IDE integration
- You want to enforce install-time gating rather than after-the-fact auditing
Skip for now if
- You do not use AI agent skills or MCP servers
- You need a fully managed SaaS scanner with no local infrastructure
- You require scanning capabilities for languages or runtimes beyond the agent-skill threat model
Risks and cautions
SkillSpector is Apache-2.0, runs locally with no API keys for static scans, and offers Docker and uv-based installation paths. The main consideration is the Python 3.12+ requirement and the optional LLM provider setup for full semantic analysis.
- Static-only mode works with zero external dependencies via --no-llm
- Docker image based on the official Python 3.12-slim-bookworm requires no host Python
- Apache-2.0 license is enterprise-friendly with a DCO contribution model
- Requires Python 3.12+ which may need environment updates on older systems
- LLM semantic analysis requires provider credentials and incurs API costs
- Detects 68 vulnerability patterns across 17 categories including prompt injection, data exfiltration, and privilege escalation
- Live CVE lookups via OSV.dev with automatic offline fallback
- Baseline and false-positive suppression using glob rules or fingerprints so re-scans surface only new findings
- MCP server mode allows agents to gate skill and MCP installs on scan results
- YARA signatures and AST-based dangerous-code detection for deep static analysis
Alternatives to compare
| Approach | When to use | Trade-off |
|---|---|---|
Semgrep | You need general-purpose static analysis across many languages, not just agent skills | Free / open-source |
Bandit | You want a lightweight Python-specific security linter | Free / open-source |
Custom CI scanning scripts | Your threat model is narrow enough that a few grep-based rules suffice | Free |
What this trend reveals
CI/CD Policy Enforcement
SARIF output lets you plug SkillSpector into existing GitHub Actions or GitLab CI pipelines to block merges that introduce high-risk skills.
Run a sample scan on your current skill repositories with --format sarif and review the findings against your team's risk tolerance.
Runtime Install Gate via MCP
The MCP server exposes a scan_skill tool that returns safe_to_install, enabling agents to automatically reject unsafe skills before activation.
Register the MCP server with Claude Code or your agent runtime and test whether a known-vulnerable skill is blocked.
Baseline-Driven Continuous Scanning
The baseline feature lets teams accept known findings and track only new issues across skill updates, reducing alert fatigue.
Generate a baseline for your most-used skill, then update the skill and scan again to confirm only new findings surface.
RepoDaily verdict
SkillSpector fills a critical gap in the AI agent ecosystem: pre-installation security vetting for skills and MCP servers. With 68 detection patterns, optional LLM semantic analysis, SARIF output for CI integration, and an MCP server mode for runtime gating, it is a practical and well-architected tool for any team serious about agent security.