SkillSpector
Level ALocalSecurity scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
SkillSpector is NVIDIA's security scanner for AI agent skills. Before you install skills for Claude Code, Codex CLI, Gemini CLI, or MCP, it checks for vulnerabilities, malicious patterns, prompt injection, data exfiltration, privilege escalation, and supply-chain risks. It covers 71 patterns across 17 categories, combining fast static analysis with optional LLM evaluation, and produces a 0–100 risk score with terminal, JSON, Markdown, or SARIF reports.
Installation
MCP client config (paste into mcp.json)
{
"mcpServers": {
"skillspector": {
"command": "skillspector",
"args": [
"mcp"
]
}
}
}Agent install prompt
Copy and paste into Cursor / Claude / other agents to install this MCP for you
Please read this MCP repository and install it into my current environment:
https://github.com/NVIDIA/SkillSpector
Known working client config (can write into mcp.json):
{
"mcpServers": {
"skillspector": {
"command": "skillspector",
"args": [
"mcp"
]
}
}
}
Please: 1) check README for deps and env vars; 2) write config for my client; 3) if secrets are missing, tell me what to fill — do not invent values.