NVIDIA/SkillSpector

Features

• Multi-format input: Scan Git repos, URLs, zip files, directories, or single files
• 71 vulnerability patterns across 17 categories: prompt injection, data exfiltration, privilege escalation, supply chain, excessive agency, output handling, system prompt leakage, memory poisoning, too
• Two-stage analysis: Fast static analysis + optional LLM semantic evaluation
• Live vulnerability lookups: SC4 queries OSV.dev for real-time CVE data with automatic offline fallback
• Multiple output formats: Terminal, JSON, Markdown, and SARIF reports
• Risk scoring: 0-100 score with severity labels and clear recommendations
• Baseline / false-positive suppression: Accept known findings via a glob-rule or fingerprint baseline so re-scans surface only new issues (docs)

Installation

Create and activate a virtual environment first (all make targets assume the venv is active). Use uv or pip; the Makefile uses uv if available, otherwise pip.

If you plan to run skillspector mcp, install the MCP extra at install time:

uv tool install git+https://github.com/NVIDIA/skillspector.git
# Update later: uv tool update skillspector

Setup

All make targets assume a virtual environment is already created and activated. The Makefile uses uv if available, else pip.

# Clone, create venv, activate, install dev dependencies
git clone https://github.com/NVIDIA/skillspector.git
cd skillspector
uv venv .venv && source .venv/bin/activate
# or: python3 -m venv .venv && source .venv/bin/activate
make install-dev

# Run tests
make test

# Run tests with coverage
make test-cov

# Run linting
make lint

# Format code
make format

Basic Usage

SkillSpector enforces two independent caps on remote and archive inputs to bound the impact of oversized downloads and zip bombs:

Note that the per-file 1 MB analysis cap (MAXFILEBYTES) is a separate, downstream limit: it bounds what individual analyzers will read out of an already-ingested directory. The ingest caps above bound how much content can land on disk in the first place. A breach of either ingest cap fails closed with an IngestLimitExceededError.

• Per-ingest cap: INGESTMAXBYTES (100 MiB) — applied to streamed URL downloads, total uncompressed size of zip archives, and post-clone disk usage of Git repos.
• Zip member cap: INGESTMAXZIPMEMBERS (10,000) — caps the number of entries in a single zip.

# Scan a local skill directory
skillspector scan ./my-skill/

# Scan a single SKILL.md file
skillspector scan ./SKILL.md

# Scan a Git repository
skillspector scan https://github.com/user/my-skill

# Scan a zip file
skillspector scan ./my-skill.zip

CLI Options

Report files and new baselines use private permissions (0600). Existing baselines retain their access metadata when safely replaced; updates requiring in-place writes are refused. All file output uses atomic replacement. The parent directory must be writable; symlinked parents and non-regular destinations such as devices are refused. On macOS, ancestor directories must also be readable. File output requires POSIX no-follow directory operations and is unavailable on Windows. Unsupported file output fails before analysis. Omit --output for scan/batch stdout, or use skillspector baseline -o - for

skillspector scan --help

Options:
  -f, --format [terminal|json|markdown|sarif]  Output format [default: terminal]
  -o, --output PATH                            Output file path
  --no-llm                                     Skip LLM analysis (static only)
  --yara-rules-dir PATH                        Extra YARA rules directory
  -b, --baseline PATH                          Suppress findings listed in a baseline
  --show-suppressed                            List baseline-suppressed findings

Limitations

• Non-English content: May miss patterns in other languages
• Image-based attacks: Cannot analyze text in images
• Encrypted/binary code: Cannot analyze compiled or encrypted content
• Runtime behavior: Static analysis only, no dynamic execution
• Offline SC4: Without network access to api.osv.dev, SC4 uses a small static fallback list

Documentation

• Scan agent skills before installation — Hosted guide: when to scan, how to read a report, and how to gate installs.
• Development guide — Architecture, package layout, and how to extend the analyzer pipeline.
• Analysis resource bounds — Fail-closed bundle, parser, nested-artifact, ledger, and finding ceilings.
• Pi extension — Install SkillSpector as a Pi tool for scanning skills from inside agent sessions.
• OpenCode extension — Install SkillSpector as an OpenCode tool and /skillspector command for scanning skills from inside agent sessions.