#10 · Primary category： Cybersecurity & Decryption Tools
SkillSpector
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
Project last updated：08/28/26
GitHub Stars
15.2K
Forks
1.3K
Contributors
63
License
Apache-2.0
Why we included this project
Agent skills run with implicit trust and barely any vetting, yet most people pull them straight from a repo or URL. SkillSpector answers the practical question of whether a skill is safe to install by scanning Git repos, zip files, directories, or a single file before you load it into Claude Code, Codex, or an MCP server. Its two-stage pipeline does a fast static pass that matches 68 vulnerability patterns across 17 categories, from prompt injection and data exfiltration to privilege escalation and supply chain risks, then optionally layers on an LLM semantic check for trickier cases. Live lookups against OSV.dev pull current CVE data, and a risk score from 0 to 100 with baseline suppression means re-scans surface only new issues rather than known ones. For teams putting agent workflows into production, it is a practical pre-install gate that also feeds into the NVIDIA Verified Skills pipeline.
Articles for this project
No articles for this project yet.
To suggest a topic or contribute an article, contact us.
Related projects in this category
reverse-skill
AI-powered skill router for reverse engineering, authorized penetration testing, and security research, with on-demand toolchain bootstrapping and self-evolving knowledge base.
gitleaks
Find secrets with Gitleaks 🔑
osquery
SQL powered operating system instrumentation, monitoring, and analytics.
NeoPass
Your Essential Exam Companion for the Iamneo Portal & NPTEL Exams Disguised as NeoExamShield bypass
anubis
Weighs the soul of incoming HTTP requests to stop AI crawlers