What can I use SkillSpector for?

Before adding a skill you found online, point SkillSpector at its Git repo or zip file and read the risk score and findings; Write a Markdown or JSON report of a skill's findings to share with your team before approving it; Re-scan after changes with a baseline, so accepted known findings are hidden and only new issues appear

Can I run SkillSpector on my computer?

SkillSpector runs on your own computer from a terminal, installed with uv or pip (Python 3.12 or newer) or built as a Docker image; only the optional AI review step needs credentials.

What do I need to use SkillSpector?

Python with a virtual environment, or Docker if you would rather not install Python. The optional AI review step needs credentials passed in; hardware needs are not documented.

SkillSpector: Check AI agent skills for risks before installing

What it does

SkillSpector checks an agent skill (an add-on that gives an AI assistant new abilities) in two stages: fast static analysis of its files, then an optional AI review of what the skill does. It looks for risks like prompt injection and data exfiltration, then gives a risk score and report.

How to use it

Install it with uv or pip inside a virtual environment, or build the included Docker image and mount your folder to scan it. Point it at a Git repo, URL, zip file, folder or single file, and read the report in the terminal, JSON, Markdown or SARIF.

Common use cases

Before adding a skill you found online, point SkillSpector at its Git repo or zip file and read the risk score and findings.
Write a Markdown or JSON report of a skill's findings to share with your team before approving it.
Re-scan after changes with a baseline, so accepted known findings are hidden and only new issues appear.

Can I use this?

Setup details on the source page

Requirements Create and activate a virtual environment, then install with uv or pip. Docker is an alternative that does not need Python on your machine. Passing credentials in a local .env file enables the AI analysis.

Caveat The source notes that installing downloads extra third-party open source software, so review those license terms before use. Licensed under Apache-2.0.

Worth knowing Remote downloads and zip files are capped by size limits, and each file is only analyzed up to a set size.

Why it's here

Not trending this week

Last seen on the GitHub trending list on 4 November 2026. It stays on BuildTube so you can still find it.

24,870 people have starred it on GitHub.

Numbers checked on 8 November 2026; not refreshed since.

Behind it

View setup guide

BuildTube has not run or verified this project. Everything above is written from what the creator published.

Made this?

Quick questions

What is SkillSpector?: SkillSpector checks an agent skill (an add-on that gives an AI assistant new abilities) in two stages: fast static analysis of its files, then an optional AI review of what the skill does.
What can I use SkillSpector for?: Before adding a skill you found online, point SkillSpector at its Git repo or zip file and read the risk score and findings; Write a Markdown or JSON report of a skill's findings to share with your team before approving it; Re-scan after changes with a baseline, so accepted known findings are hidden and only new issues appear
Can I run SkillSpector on my computer?: SkillSpector runs on your own computer from a terminal, installed with uv or pip (Python 3.12 or newer) or built as a Docker image; only the optional AI review step needs credentials.
What do I need to use SkillSpector?: Python with a virtual environment, or Docker if you would rather not install Python. The optional AI review step needs credentials passed in; hardware needs are not documented.
What license does SkillSpector use?: Licensed under Apache-2.0.

More from this week

Stroq Check AI coding agent sessions for leaked keys
Stroq scans your recent Claude Code and Codex sessions for keys that left your machine.
Runs in a terminalAdded 6 Nov
agent-desktop Let AI agents read and click desktop apps
For developers building computer-use agents: agent-desktop lets an AI agent read and operate desktop apps on Mac, Windows or Linux from a command line.
+13,858 stars this weekAdded 3 Nov
OpenBot Run AI coworkers with their own browser and files
Give an AI coworker a job, connect the tools it needs and watch it work.
+1,312 stars this weekDesktop appAdded 7 Nov

Related projects

Stroq Check AI coding agent sessions for leaked keys
Same topic: agent-security
Runs in a terminalAdded 6 Nov
Paperclip Give a team of AI agents a business goal and watch them run it
Same topic: agent-skills
Runs in a terminalAdded 25 Sept
wshobson/agents add 94 ready-made coding plugins to Claude Code, Codex or Cursor
Same topic: agent-skills
Add-on for an AI assistantAdded 21 Oct
rea Ask AI to explain an app without its source code
Same topic: agent-skills
Runs in a terminalAdded 14 Oct
pstack-claude Route coding tasks through engineering workflows
Same topic: agent-skills
Add-on for an AI assistantAdded 21 Oct
ECC Give your coding agent a plan, test and review routine
Same topic: claude-code
+5,486 stars this weekAdd-on for an AI assistantAdded 18 Sept

Explore by topic

Post this

For makers

Made this? Show it’s on BuildTube — add the badge to your README or embed the card on your site.

README badge (Markdown)

[![Featured on BuildTube](https://buildtube.app/badge/gh-nvidia-skillspector.svg)](https://buildtube.app/p/gh-nvidia-skillspector/)

Embed card (HTML)

<iframe src="https://buildtube.app/embed/gh-nvidia-skillspector/" width="560" height="240" style="border:0;max-width:100%" loading="lazy" title="SkillSpector on BuildTube"></iframe>