Devtoolwatch BoardSkillSpector review
SkillSpector is NVIDIA's security scanner that checks AI agent skills for vulnerabilities, malicious patterns, and supply-chain risks before you install them.
TL;DR
SkillSpector is a Python command-line scanner that checks Claude Code, Codex, and MCP agent skills for risks such as prompt injection and data exfiltration. It is for developers who want to vet skills before installing them. It runs fast static checks by default, adds optional LLM semantic analysis, and is part of NVIDIA's Verified Skills pipeline.
- 23.7kGitHub stars
- +2.4knew stars, week of Oct 25
- #1in Evals and observability this week
SkillSpector at a glance
- Category
- Evals and observability
- Maintained by
- NVIDIA Corporation (organization, @NVIDIA on GitHub)
- License
- Apache 2.0
- Language
- Python, TypeScript, JavaScript
- Repository
- github.com/NVIDIA/SkillSpector
- Website
- docs.nvidia.com/skills/scanning-agent-skills
- Latest release
- v2.13.2 on GitHub, Oct 28, 2026
- First published
- Mar 21, 2026
What SkillSpector does
- SkillSpector scans Git repositories, URLs, zip files, directories, or single SKILL.md files.
- SkillSpector checks vulnerability patterns across 17 categories, including prompt injection, data exfiltration, privilege escalation, memory poisoning, and MCP tool poisoning.
- SkillSpector queries OSV.dev for known vulnerable dependencies and falls back to offline data when network access is unavailable.
- SkillSpector gives each scan a 0-100 risk score with severity labels and recommendations.
- SkillSpector writes reports as terminal output, JSON, Markdown, or SARIF for CI and IDE tooling.
- SkillSpector supports baseline files that suppress accepted findings, so re-scans report and score only new issues.
- SkillSpector can scan and compare MCP Registry snapshots, listing added, removed, and changed servers.
How it works
SkillSpector runs as a CLI command, `skillspector scan`, either installed with uv or pip or inside a locally built Docker image. Static analysis runs by default. For semantic analysis, you set SKILLSPECTOR_PROVIDER and an API key for an OpenAI-compatible endpoint, Anthropic, or a local server such as Ollama, vLLM, or llama.cpp. The LLM then compares what a skill claims with what its code appears to do.
How to install and start using SkillSpector
With uv (CLI only)
uv tool install git+https://github.com/NVIDIA/skillspector.gitWith uv, including the MCP extra
uv tool install 'skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git'Build the Docker image
docker build -t skillspector .Requirements
- Python in a virtual environment, created with uv or pip, unless you use the Docker image.
- Docker, if you want to run SkillSpector without installing Python. The image is based on Python 3.12-slim-bookworm.
- An LLM provider and API key, needed only for optional semantic analysis.
First steps
- Scan a local skill directory with `skillspector scan ./my-skill/`.
- Write a machine-readable report with `skillspector scan ./my-skill/ --format json --output report.json`.
- For semantic checks, set SKILLSPECTOR_PROVIDER and the matching API key, such as OPENAI_API_KEY, before scanning.
- Accept known findings with `skillspector baseline ./my-skill/ -o .skillspector-baseline.yaml`, then scan with `--baseline`.
Who SkillSpector is for
- Developers vetting third-party Claude Code, Codex, or MCP skills before installing them.
- Teams gating skill installs in CI with SARIF output and fail-on-incomplete checks.
- Skill authors preparing skills for publication through NVIDIA's evaluation pipeline.
- Teams tracking changes between MCP Registry snapshots.
Limitations to know
- SkillSpector caps remote and archive inputs at 100 MiB and 10,000 zip entries. Analyzers read at most 1 MB per file.
- SkillSpector's recursive scans default to 32 skills. Time and size budgets can still leave coverage incomplete.
- SkillSpector disabled the Codex CLI analysis provider because its read-only sandbox permits access to host secrets.
- SkillSpector's contributed batch scanner defaults to DeepSeek and was not tested against local models.
Is SkillSpector growing? Usage data
In the week of Oct 25–31, 2026, SkillSpector ranked #13 on the Devtoolwatch Board and #1 in Evals and observability, with a momentum score of 94 out of 100.
Show the weekly numbers
| Week of | New stars |
|---|---|
| Aug 9, 2026 | 288 |
| Aug 16, 2026 | 225 |
| Aug 23, 2026 | 345 |
| Aug 30, 2026 | 1.1k |
| Sep 6, 2026 | 741 |
| Sep 13, 2026 | 813 |
| Sep 20, 2026 | 543 |
| Sep 27, 2026 | 919 |
| Oct 4, 2026 | 617 |
| Oct 11, 2026 | 566 |
| Oct 18, 2026 | 976 |
| Oct 25, 2026 | 2.4k |
On Hacker News
- CUDA 11.0, 182 points and 65 comments (Jul 8, 2020)
- CUDA Toolkit Release Notes, 160 points and 119 comments (Nov 24, 2019)
- SkillSpector, 49 points and 4 comments (Jun 12, 2026)
- Tile IR Specification, 19 points and 3 comments (Dec 4, 2025)
- Nvidia uses raytracing to model 5G network design, 6 points and 0 comments (Jul 4, 2024)
The Board ranks tools by four signals each week: new stars, new stars for the repo's size, added downloads and download growth beyond the market. How the ranking works.
SkillSpector alternatives
Other LLM evals and observability tools on the Board in the week of Oct 25–31, 2026, by momentum:
| Rank | Tool | Stars | Downloads/wk |
|---|---|---|---|
| #2 | JudgevalJudgeval is an open-source Python SDK for tracing and evaluating LLM-powered agents with prompt-based judges and online monitoring. | 1.1k | 80.2k |
| #3 | A.I.G (AI-Infra-Guard)A full-stack AI Red Teaming platform securing AI ecosystems via Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak… | 7.2k | – |
| #4 | LangfuseLangfuse is an open source LLM engineering platform for tracing, evaluating, prompt management, and debugging LLM applications and agents. | 36.8k | 9.8M |
| #5 | OpikOpik is an open-source platform from Comet for tracing, evaluating, and monitoring LLM applications, RAG systems, and AI agents. | 23.1k | 709.1k |
| #6 | promptfoopromptfoo is a CLI and library for evaluating and red-teaming LLM-based apps, including prompts, agents, and RAG pipelines. | 26.7k | 1.2M |
| #7 | garakgarak is a command-line LLM vulnerability scanner from NVIDIA that probes models for jailbreaks, prompt injection, data leakage,… | 9.8k | 12.9k |
Recent SkillSpector releases
SkillSpector FAQ
Is SkillSpector free and open source?
Yes. SkillSpector's source code is on GitHub (NVIDIA/SkillSpector) under the Apache 2.0 license, so you can use it for free.
How do I install SkillSpector?
Run uv tool install git+https://github.com/NVIDIA/skillspector.git. The install section above has the other options from the project's README.
Is SkillSpector still maintained?
Yes. The NVIDIA/SkillSpector repository was last updated on Oct 31, 2026, and the latest release, v2.13.2 on GitHub, came out on Oct 28, 2026.
How popular is SkillSpector?
SkillSpector has 23.7k GitHub stars as of Nov 1, 2026. It gained 2.4k new stars in the week of Oct 25–31, 2026, against a 12-week average of 791 a week. That made it #1 among LLM evals and observability tools on the Devtoolwatch Board.
What are the best alternatives to SkillSpector?
Other LLM evals and observability tools on the Devtoolwatch Board in the week of Oct 25–31, 2026, by momentum: Judgeval (#2), A.I.G (AI-Infra-Guard) (#3), Langfuse (#4), Opik (#5), promptfoo (#6). The alternatives table above has their numbers.
Is SkillSpector legit?
SkillSpector is published by NVIDIA in the NVIDIA GitHub organization. It is part of the NVIDIA Verified Skills pipeline, which scans, evaluates, and signs agent skills before they are published to the NVIDIA skills catalog. It also serves as the security tier inside SkillEvaluator.
Does SkillSpector need an LLM?
SkillSpector does not need an LLM. It runs fast, deterministic static checks by default, and --no-llm keeps scans static. Optional LLM semantic analysis compares what a skill claims with what its code appears to do. This helps catch description-behavior mismatches and vague triggers.
Can SkillSpector run in CI?
SkillSpector can run in CI. It writes SARIF reports for CI and code scanning systems, and JSON reports for automation. The --fail-on-incomplete flag fails a build when scan coverage is incomplete.
How do I handle false positives in SkillSpector?
SkillSpector supports baselines. Create one with skillspector baseline, then scan with --baseline so that only new findings are reported and scored. Baselines can use glob rules or exact fingerprints. Fingerprints stay active again when the source or the SkillSpector version changes.
Which LLM providers does SkillSpector support?
SkillSpector works with OpenAI-compatible endpoints, Anthropic, and local OpenAI-compatible servers such as Ollama, vLLM, and llama.cpp. You select one with SKILLSPECTOR_PROVIDER. The Codex CLI provider is disabled.
Sources
SkillSpector README badge
Maintainers can show the tool's weekly Board rank in their README:
[](https://index.devtoolwatch.com/tools/nvidia-skillspector/)How this page is made: Devtoolwatch writes each review from the project's README, releases, package metadata and website, with an AI model, then checks every claim against the source it cites and drops what the sources don't support. The numbers come from Devtoolwatch's daily GitHub snapshots, GitHub's stargazer history, and the npm and PyPI download APIs. Spotted an error? Email [email protected].