SkillSpector

What it is

NVIDIA's scanner for AI agent skills. It accepts Git repositories, URLs, ZIP archives, local directories and single files such as SKILL.md. It reads eligible skill content using static checks and optional LLM analysis, then produces findings to review. It does not execute the scanned skill.

Setup

1. Have uv, Git and Python 3.12–3.14 available. Install the CLI from the official repository.

   uv tool install git+https://github.com/NVIDIA/skillspector.gitCopy

2. Scan a local skill folder using static checks only. Replace the example folder with your skill's path.

   skillspector scan ./my-skill/ --no-llmCopy

3. Save findings as a JSON report for your next step.

   skillspector scan ./my-skill/ --no-llm --format json --output report.jsonCopy

4. Review the reported files, lines and explanations before deciding whether to install the skill.

Cheat sheet

• Repository and installation.
• Official scan guide.
• Trust model and limitations.
• Replace the input path with a SKILL.md file, a ZIP file or a repository URL. Terminal, JSON, Markdown and SARIF outputs are supported.
• --no-llm disables optional semantic LLM analysis. It does not disable the OSV.dev dependency lookup: that check sends package names and versions, with an offline fallback.
• Optional LLM analysis needs a configured provider and credentials or an authenticated local runtime; eligible file contents go to that provider. Provider charges or subscription usage may apply.
• Apache-2.0 licensed. The scanner can flag false positives and miss some risks. It is not a sandbox or a safety certificate; review findings and limitations.