SkillSpector
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks i…
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks i… Added from the nightly trending feed on 2026-10-27 with 22,247 GitHub stars. So far only the licence comes from GitHub; the other facts are unknown until someone checks them.
The facts
| Question | Answer | Source | Checked |
|---|---|---|---|
| Runs on my machine? | Yes. Yes, a local scanner; static analysis needs no LLM and LLM analysis can use a local Ollama server | github.com | Checked 5 days ago |
| Code licence | Open source. Apache-2.0 | github.com | Checked 7 days ago |
| Commercial use | Yes. Yes, Apache-2.0 allows commercial use | github.com | Checked 5 days ago |
| Paid services needed? | Optional. Static scans are free; best results need an LLM provider, which may need a paid API key unless you run a local model | github.com | Checked 5 days ago |
| Hardware | Unknown. Not documented (checked README) | Know the answer? | Not checked yet |
| Operating systems | Unknown. Not documented; the README shows Python 3.12+ and a Docker image but no Windows/macOS/Linux support matrix | Know the answer? | Not checked yet |
| Setup effort | Medium; install with uv or pip (Python 3.12+) or build the Docker image; LLM scans also need provider credentials | github.com | Checked 5 days ago |
Each fact has its own date. Unknown means nobody has published it. We read their documentation; we didn’t install it. Running it yourself costs your hardware, electricity and setup time. Report a correction.
No licence changes since we started watching. Licence changes: follow SkillSpector and we email you if its terms change.
Stars over time
Building history Not enough history for a 7-day gain. Stars show attention, not quality. Where these numbers come from.