{
 "schema_version": 1,
 "generated": "2026-10-26",
 "id": "nvidia-skillspector--scan-an-agent-skill-before-installing",
 "repo": "NVIDIA/SkillSpector",
 "repo_url": "https://github.com/NVIDIA/SkillSpector",
 "repo_slug": "nvidia-skillspector",
 "title": "Scan an agent skill for prompt injection and exfiltration before installing",
 "page_title": "How to scan an agent skill for prompt injection and exfiltration before installing with Skill Spector",
 "summary": "Run Skill Spector on a skill directory or repo and read its risk score and findings first.",
 "who": "A developer about to install a community skill into Claude Code or Codex.",
 "problem": "Skills run with implicit trust; the README cites research where 26.1% of analyzed skills had vulnerabilities and 5.2% showed likely malicious intent.",
 "outcome": "A 0 to 100 risk score with severity labels and findings, so you decide whether to install.",
 "steps": [
  "Install with `uv tool install git+https://github.com/NVIDIA/skillspector.git`",
  "Download or clone the skill you want to check",
  "Scan it without LLM costs using Docker: `docker run --rm -v \"$PWD:/scan\" skillspector scan ./my-skill/ --no-llm`",
  "Read the risk score, severity labels and recommendations",
  "Install the skill only if the findings are acceptable"
 ],
 "agent_prompt": "Use NVIDIA/SkillSpector to scan the skill at <path or repo> before I install it. Run static analysis only, then summarize the risk score and each finding in plain words, and recommend install, review or reject.",
 "agents": [
  "claude-code",
  "codex",
  "gemini-cli"
 ],
 "difficulty": "Beginner",
 "time": "10 minutes",
 "basis": "readme",
 "caveat": "A clean scan lowers risk but is not a guarantee; static analysis cannot prove a skill is safe.",
 "category": "Software and DevOps",
 "tags": [
  "Software and DevOps"
 ],
 "lang": "python",
 "requirements": [
  "Python with uv or pip, or Docker (no Python required)",
  "Optional: an LLM API key in .env for semantic analysis (default config targets DeepSeek)",
  "Optional MCP extra for skillspector mcp"
 ],
 "risk": "none",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [],
 "best": true,
 "score": 1.0,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/nvidia-skillspector/scan-an-agent-skill-before-installing/",
 "md": "https://dedupedai.com/use-cases/nvidia-skillspector/scan-an-agent-skill-before-installing/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/nvidia-skillspector--scan-an-agent-skill-before-installing.json",
 "api_version": "v1"
}