{
 "schema_version": 1,
 "generated": "2026-10-26",
 "repo": "NVIDIA/SkillSpector",
 "name": "SkillSpector",
 "owner": "NVIDIA",
 "slug": "nvidia-skillspector",
 "github": "https://github.com/NVIDIA/SkillSpector",
 "what": "SkillSpector is NVIDIA's security scanner for AI agent skills used by Claude Code, Codex CLI, Gemini CLI and others. It scans Git repos, URLs, zips, directories or single files for 71 vulnerability patterns in 17 categories, including prompt injection, data exfiltration and MCP tool poisoning, with fast static analysis plus optional LLM evaluation, live OSV.dev CVE lookups, a 0 to 100 risk score and Terminal, JSON, Markdown or SARIF reports.",
 "why": "22k stars, picked up by one AI source we track",
 "language": "Python",
 "requirements": [
  "Python with uv or pip, or Docker (no Python required)",
  "Optional: an LLM API key in .env for semantic analysis (default config targets DeepSeek)",
  "Optional MCP extra for skillspector mcp"
 ],
 "audience_note": "Developers and security teams who install third-party agent skills or MCP servers and want to know whether they are safe first.",
 "risk": "none",
 "section": "earlier",
 "weekly_rank": null,
 "category": "Software and DevOps",
 "url": "https://dedupedai.com/use-cases/nvidia-skillspector/",
 "use_case_count": 3,
 "use_cases": [
  {
   "id": "nvidia-skillspector--scan-an-agent-skill-before-installing",
   "title": "Scan an agent skill for prompt injection and exfiltration before installing",
   "best": true,
   "url": "https://dedupedai.com/use-cases/nvidia-skillspector/scan-an-agent-skill-before-installing/",
   "json": "https://dedupedai.com/use-cases/u/nvidia-skillspector/scan-an-agent-skill-before-installing.json"
  },
  {
   "id": "nvidia-skillspector--gate-skill-changes-with-a-baseline",
   "title": "Gate skill updates in CI so only new findings fail",
   "best": false,
   "url": "https://dedupedai.com/use-cases/nvidia-skillspector/gate-skill-changes-with-a-baseline/",
   "json": "https://dedupedai.com/use-cases/u/nvidia-skillspector/gate-skill-changes-with-a-baseline.json"
  },
  {
   "id": "nvidia-skillspector--compare-mcp-registry-snapshots",
   "title": "Spot new or changed MCP servers between registry snapshots",
   "best": false,
   "url": "https://dedupedai.com/use-cases/nvidia-skillspector/compare-mcp-registry-snapshots/",
   "json": "https://dedupedai.com/use-cases/u/nvidia-skillspector/compare-mcp-registry-snapshots.json"
  }
 ],
 "disclaimer": "Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk."
}