AI Inspiration WorldWhat it is
SkillSpector is an open-source security tool from NVIDIA. The README describes it as a "security scanner for AI agent skills." Before you install a skill someone else wrote, you can scan it for malicious patterns, code that sends data out, and supply-chain risk in its dependencies. The author says its rules cover 71 patterns in 17 categories. It can run static checks only (--no-llm mode) or add a semantic pass with an LLM. What sets it apart is that it's built specifically to check skills.
Who it's for:Developers and teams who install skills from the web and care about security. Readers who don't write code won't get much use from it.
Before you start: You need Python 3.12 or later, installed with uv, pip or Docker. With LLM analysis on, the skill's content goes to the model service, and dependency checks may go online to query the OSV vulnerability database. Start with the static mode that doesn't use a model. A clean scan does not prove a skill is safe. The optional MCP and extensions have their own documentation. The code is free under the Apache-2.0 license.
Based on the project's public documentation. Not tested by AI Inspiration World.