DEDUPED Hot AI repos, turned into use cases Get the Monday 5

How to use Skill Spector: what you can do with it

What is Skill Spector? SkillSpector is NVIDIA's security scanner for AI agent skills used by Claude Code, Codex CLI, Gemini CLI and others. It scans Git repos, URLs, zips, directories or single files for 71 vulnerability patterns in 17 categories, including prompt injection, data exfiltration and MCP tool poisoning, with fast static analysis plus optional LLM evaluation, live OSV.dev CVE lookups, a 0 to 100 risk score and Terminal, JSON, Markdown or SARIF reports.

How do I use it? Install with uv tool install git+https://github.com/NVIDIA/skillspector.git; then download or clone the skill you want to check; Scan it without LLM costs using Docker: docker run --rm -v "$PWD:/scan" skillspector scan ./my-skill/ --no-llm. Full steps below.

Trended earlier

View repo on GitHub

Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer

What do you want to do?

3 use cases

Quick start with Skill Spector

  1. Check you have what it needs: Python with uv or pip, or Docker (no Python required); Optional: an LLM API key in .env for semantic analysis (default config targets DeepSeek); Optional MCP extra for skillspector mcp.
  2. Open NVIDIA/SkillSpector on GitHub and read the README and license.
  3. Install with uv tool install git+https://github.com/NVIDIA/skillspector.git
  4. Download or clone the skill you want to check
  5. Scan it without LLM costs using Docker: docker run --rm -v "$PWD:/scan" skillspector scan ./my-skill/ --no-llm
  6. Read the risk score, severity labels and recommendations

These steps come from our top use case, Scan an agent skill for prompt injection and exfiltration before installing, which also has a copy-paste agent prompt.

Use this in your AI agent

Ask your agent

Using the Deduped MCP, get the setup steps for NVIDIA/SkillSpector

Add Deduped to Claude Code once

claude mcp add --transport http deduped https://dedupedai.com/mcp

Cursor, ChatGPT, others

Skill Spector alternatives · Best AI repos for Software and DevOps

About this repo

  • Who it is forDevelopers and security teams who install third-party agent skills or MCP servers and want to know whether they are safe first.
  • Why it is hot22k stars, picked up by one AI source we track
  • LanguagePython
  • Sourcegithub.com/NVIDIA/SkillSpector · Back to Hot repos

Requirements

  • Python with uv or pip, or Docker (no Python required)
  • Optional: an LLM API key in .env for semantic analysis (default config targets DeepSeek)
  • Optional MCP extra for skillspector mcp

Add this badge to your README

Maintain Skill Spector? Show readers where to find these use cases. Use cases on Deduped

Markdown 

[![Use cases on Deduped](https://dedupedai.com/badge/NVIDIA/SkillSpector.svg)](https://dedupedai.com/use-cases/nvidia-skillspector/?utm_source=github&utm_medium=badge&utm_campaign=NVIDIA-SkillSpector)

HTML 

<a href="https://dedupedai.com/use-cases/nvidia-skillspector/?utm_source=github&amp;utm_medium=badge&amp;utm_campaign=NVIDIA-SkillSpector"><img src="https://dedupedai.com/badge/NVIDIA/SkillSpector.svg" alt="Use cases on Deduped" height="20"></a>

A static image, no tracking script. About the badge

Questions about Skill Spector

What is Skill Spector?

SkillSpector is NVIDIA's security scanner for AI agent skills used by Claude Code, Codex CLI, Gemini CLI and others. It scans Git repos, URLs, zips, directories or single files for 71 vulnerability patterns in 17 categories, including prompt injection, data exfiltration and MCP tool poisoning, with fast static analysis plus optional LLM evaluation, live OSV.dev CVE lookups, a 0 to 100 risk score and Terminal, JSON, Markdown or SARIF reports. It is an open-source project on GitHub: https://github.com/NVIDIA/SkillSpector.

How do I use Skill Spector?

Install with uv tool install git+https://github.com/NVIDIA/skillspector.git; then download or clone the skill you want to check; Scan it without LLM costs using Docker: docker run --rm -v "$PWD:/scan" skillspector scan ./my-skill/ --no-llm. The use cases on this page give the full steps and a copy-paste agent prompt for each job.

Who is Skill Spector for?

Developers and security teams who install third-party agent skills or MCP servers and want to know whether they are safe first.

What can I do with Skill Spector?

3 use cases so far, for example: Scan an agent skill for prompt injection and exfiltration before installing; Gate skill updates in CI so only new findings fail; Spot new or changed MCP servers between registry snapshots. Each has steps and a copy-paste agent prompt.

What do I need to run Skill Spector?

Python with uv or pip, or Docker (no Python required); Optional: an LLM API key in .env for semantic analysis (default config targets DeepSeek); Optional MCP extra for skillspector mcp.

What are alternatives to Skill Spector?

Other hot AI repos in Software and DevOps: Deep Infer, Harness2, Orca, Opencode, Graphify.

Is Skill Spector safe to run?

Deduped does not own, audit or vouch for it. Read the README and license, run it on your own systems first and review every command before you run it.