skillspector
Level ALocalSecurity scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
SkillSpector is NVIDIA's security scanner for AI agent skills, checking Claude Code, Codex, and MCP skills for vulnerabilities and malicious patterns before installation. It covers 71 patterns across 17 categories, including prompt injection, data exfiltration, privilege escalation, and supply-chain risk. Two-stage analysis combines fast static checks with optional LLM semantic evaluation. It accepts repos, URLs, archives, directories, or single files, and outputs terminal, JSON, Markdown, or SA…
Installation
MCP client config (paste into mcp.json)
{
"mcpServers": {
"nvidia-skillspector-src-skillspector": {
"command": "skillspector",
"args": [
"mcp"
]
}
}
}Agent install prompt
Copy and paste into Cursor / Claude / other agents to install this MCP for you
Please read this MCP repository and install it into my current environment:
https://github.com/nvidia/skillspector/tree/main/src/skillspector
Known working client config (can write into mcp.json):
{
"mcpServers": {
"nvidia-skillspector-src-skillspector": {
"command": "skillspector",
"args": [
"mcp"
]
}
}
}
Please: 1) check README for deps and env vars; 2) write config for my client; 3) if secrets are missing, tell me what to fill — do not invent values.