# SkillSpector

> Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks i… Added from the nightly trending feed on 2026-10-27 with 22,247 GitHub stars. So far only the licence comes from GitHub; the other facts are unknown until someone checks them.

- Repository: https://github.com/NVIDIA/SkillSpector
- Official docs: https://github.com/NVIDIA/SkillSpector#readme
- Checked: 2026-10-29

## What it replaces
Nothing people pay for: a free tool, listed because people search for it.

## Facts, with sources

| Question | Status | Answer | Source | Checked |
|---|---|---|---|---|
| Runs on my machine? | Confirmed | Yes, a local scanner; static analysis needs no LLM and LLM analysis can use a local Ollama server | https://github.com/NVIDIA/SkillSpector/blob/HEAD/README.md | 2026-10-29 |
| Code licence | Confirmed | Apache-2.0 | https://github.com/NVIDIA/SkillSpector#license | 2026-10-27 |
| Model weights licence | Confirmed | No bundled weights; optional LLM analysis uses whichever provider or local model you configure | https://github.com/NVIDIA/SkillSpector/blob/HEAD/README.md | 2026-10-29 |
| Commercial use | Confirmed | Yes, Apache-2.0 allows commercial use | https://github.com/NVIDIA/SkillSpector/blob/HEAD/LICENSE | 2026-10-29 |
| Paid services needed? | Partial | Static scans are free; best results need an LLM provider, which may need a paid API key unless you run a local model | https://github.com/NVIDIA/SkillSpector/blob/HEAD/README.md | 2026-10-29 |
| Hardware | Unknown | Not documented (checked README) | none found | - |
| Operating systems | Unknown | Not documented; the README shows Python 3.12+ and a Docker image but no Windows/macOS/Linux support matrix | none found | - |
| Setup effort | Confirmed | Medium; install with uv or pip (Python 3.12+) or build the Docker image; LLM scans also need provider credentials | https://github.com/NVIDIA/SkillSpector/blob/HEAD/README.md | 2026-10-29 |

GitHub: 24016 stars, 2071 forks, last push 2026-11-02, archived: no.

## Alternatives to SkillSpector
- [Superpowers](https://repoquarry.dev/projects/superpowers.md): Skill library for coding agents that walks them through brainstorming, planning, test-driven development, subagent work and code review.
- [Skills For Real Engineers (Matt Pocock)](https://repoquarry.dev/projects/mattpocock-skills.md): Matt Pocock's small, composable agent skills for engineering work, such as grilling sessions, TDD, bug diagnosis, specs and code review.
- [ECC](https://repoquarry.dev/projects/ecc.md): Large plugin of agents, skills, hooks, rules and memory for Claude Code, with native Codex and Qoder plugins and partial adapters for other agents.
- [Ponytail](https://repoquarry.dev/projects/ponytail.md): A skill (one prompt) for AI coding agents that makes them reuse what exists and write less code, plus /ponytail-review and /ponytail-audit commands.
- [UI UX Pro Max](https://repoquarry.dev/projects/ui-ux-pro-max.md): Design skill for Claude Code, Cursor, Codex and other agents that picks UI styles, palettes, fonts and UX rules and generates a design system.
- [Graphify](https://repoquarry.dev/projects/graphify.md): A /graphify skill that maps a codebase and its docs into a knowledge graph your coding agent queries instead of grepping files.
---
Source: RepoQuarry (https://repoquarry.dev/projects/skillspector). Data licence: CC BY 4.0. Quotes are from project documentation and belong to their authors.