What it does
"Skills" are add-on instruction packs for AI agents like Claude Code and Codex, and they often run with a lot of trust. SkillSpector scans a skill before you install it and reports possible problems.
It looks for dozens of risky patterns, such as prompt injection (hidden instructions that hijack the AI), attempts to send your data elsewhere and risky dependencies. It gives a risk score from 0 to 100 with recommendations.
It can do a fast check on its own, and an optional deeper review using an AI model. It's part of NVIDIA's process for checking skills before publishing them.
Who it's for
Developers and security teams who install or publish agent skills and want to check them first.
Can I use it without coding?
Developers only. A command-line tool installed with Python tools or Docker. New to this? Start here.
Can I run it?
- Cost
- FreeNothing to pay or sign up for.
- Privacy
- Your choice: run it on your device or use an online service
- API key
- Not needed
Try it
- Install SkillSpector with the uv tool, or build its Docker image if you don't use Python.
- Point it at a skill folder, file, zip or Git repository to scan it.
- Read the risk score and findings before deciding whether to install the skill.
Using Claude Code, Cursor or another AI coding assistant? Paste the prompt and it will walk you through the setup.New to this?
Before you install
- Only download from the official GitHub page. Copies with similar names exist for many popular projects.
- License (Apache-2.0): Permissive: free to use, change and share, including for business.
- More on staying safe
Where people are talking about it
- SkillSpectorHacker News · Jun 2026