SkillSpector

Apache NVIDIA scanner for agent skills before you install them

AI Agents / Agents · Apache-2.0 · 20.5k

Reviewed 2026-09-25 · last push 2026-10-19 · repo checked 2026-10-19

What's Good

Apache-2.0 (NVIDIA/SkillSpector). Part of the NVIDIA Verified Skills pipeline; docs at docs.nvidia.com/skills. Research-backed framing (high vuln rates in skill corpora). Gate installs in CI or locally instead of trusting a skill README.

The Catch

Vs Semgrep/Trivy-class general SAST: this is skill/MCP-skill oriented, not a whole-repo AppSec suite. Scanner signal ≠ proof a skill is safe forever — still review permissions and network egress; NVIDIA catalog signing is a separate trust path from running the OSS scanner alone.

Verdict

Apache skill security gate when your agents install third-party skills — run it before the skill runs you.

Embed

Maintainer? Add the badge to your README. It is free, links to this review, and there is no paid version.

Markdown

[![Reviewed on Stack Gems](https://stackgems.com/badge/skillspector.svg)](https://stackgems.com/gems/skillspector)

HTML

<a href="https://stackgems.com/gems/skillspector"><img src="https://stackgems.com/badge/skillspector.svg" alt="SkillSpector reviewed on Stack Gems" height="20"></a>

AI Agents →

Related