SkillSpector

Summary

SkillSpector is an open-source, Apache-licensed command-line scanner that checks AI agent skills — the kind used by Claude Code, Codex CLI, and Gemini CLI — for vulnerabilities and malicious patterns before they're installed. It's built for teams building or vetting AI agent supply chains rather than for general application security work, running static analysis across 70 vulnerability patterns (prompt injection, data exfiltration, supply-chain issues, and more) with an optional LLM-based semantic pass, and outputting terminal, JSON, Markdown, or SARIF reports for gating installs in CI. It underpins NVIDIA's Verified Skills pipeline, which scans and signs skills before they reach NVIDIA's public skills catalog. First committed in 2026, it already has 44 contributors and 61 releases in the past year, including one this week, so development is active.

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.

Command line

Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.

Release history

1. v2.11.0 Aug 28, 2026 · issue 009

   SkillSpector v2.11.0 adds npm lockfile scanning, bundled hook findings (BH1–BH3), and LLM sampling controls via SKILLSPECTOR_TEMPERATURE and SKILLSPECTOR_SEED.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v2.11.0 https://github.com/NVIDIA/SkillSpector.git
   # already have the repo? check out this version:
   $ git checkout v2.11.0

   └──▷ TRY IT
   Pin LLM sampling for reproducible semantic analysis results when scanning a skill against an OpenAI-compatible endpoint.
   copy

   $ SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY="$OPENAI_API_KEY" SKILLSPECTOR_TEMPERATURE=0 SKILLSPECTOR_SEED=42 skillspector scan ./my-skill/

   • ›Adds SKILLSPECTOR_TEMPERATURE (values 0–1) and SKILLSPECTOR_SEED (integer) environment variables for optional LLM sampling control; forwarded to OpenAI-compatible and Azure OpenAI endpoints, and left unset to preserve provider defaults.
   • ›Introduces BH1, BH2, and BH3 findings for bundled lifecycle hook execution (hooks/hooks.json), directly proven remote transfer of sensitive event or file content, and broad or ignored project permission surfaces (.claude/settings.json, .claude/settings.local.json).
   • ›Expands skillspector scan --help to list all supported hosted, local, compatible, and CLI-backed LLM providers together with their authentication paths.
   • ›Supports safe traversal of intermediate path components via O_PATH on Linux, allowing scans in restricted sandboxes where ancestor directories lack read permission, while preserving final-file and no-symlink protections.
   └──▷ BREAKING ON UPGRADE

   • !Existing scans may now surface new BH1, BH2, or BH3 findings for supported bundled hook and settings files (hooks/hooks.json, .claude/settings.json, .claude/settings.local.json); review those findings before accepting them into a baseline.
2. v2.11.0 Aug 28, 2026 · issue 002

   SkillSpector v2.11.0 adds npm lockfile scanning, bundled hook findings (BH1–BH3), and LLM sampling controls via SKILLSPECTOR_TEMPERATURE and SKILLSPECTOR_SEED.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v2.11.0 https://github.com/NVIDIA/SkillSpector.git
   # already have the repo? check out this version:
   $ git checkout v2.11.0

   └──▷ TRY IT
   Pin LLM sampling for reproducible semantic analysis results when scanning a skill against an OpenAI-compatible endpoint.
   copy

   $ SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY="$OPENAI_API_KEY" SKILLSPECTOR_TEMPERATURE=0 SKILLSPECTOR_SEED=42 skillspector scan ./my-skill/

   • ›Adds SKILLSPECTOR_TEMPERATURE (values 0–1) and SKILLSPECTOR_SEED (integer) environment variables for optional LLM sampling control; forwarded to OpenAI-compatible and Azure OpenAI endpoints, and left unset to preserve provider defaults.
   • ›Introduces BH1, BH2, and BH3 findings for bundled lifecycle hook execution (hooks/hooks.json), directly proven remote transfer of sensitive event or file content, and broad or ignored project permission surfaces (.claude/settings.json, .claude/settings.local.json).
   • ›Expands skillspector scan --help to list all supported hosted, local, compatible, and CLI-backed LLM providers together with their authentication paths.
   • ›Supports safe traversal of intermediate path components via O_PATH on Linux, allowing scans in restricted sandboxes where ancestor directories lack read permission, while preserving final-file and no-symlink protections.
   └──▷ BREAKING ON UPGRADE

   • !Existing scans may now surface new BH1, BH2, or BH3 findings for supported bundled hook and settings files (hooks/hooks.json, .claude/settings.json, .claude/settings.local.json); review those findings before accepting them into a baseline.
3. v2.10.0 Aug 26, 2026 · issue 009

   SkillSpector v2.10.0 adds transitive scanning, hidden/nested artifact inspection, EA5 detection, AISOP/AISP bundle support, and two new output controls.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v2.10.0 https://github.com/NVIDIA/SkillSpector.git
   # already have the repo? check out this version:
   $ git checkout v2.10.0

   └──▷ TRY IT
   Scan a skill and all skills it references transitively, limiting depth and restricting allowed sources, to catch supply-chain risks in referenced dependencies.
   copy

   $ skillspector scan ./my-skill/ --transitive --transitive-depth 2 --transitive-allow-prefix https://github.com/trusted-org/

   Run a scan with finding text localized to French, then check the max severity field in the JSON report to gate a CI pipeline.
   copy

   $ SKILLSPECTOR_OUTPUT_LANGUAGE=French skillspector scan ./my-skill/ --format json --output report.json && jq '.risk_assessment.max_issue_severity' report.json

   • ›Adds --transitive flag to opt into transitive scanning of referenced skills, with --transitive-depth, --transitive-allow-prefix, and --transitive-deny-prefix controls for bounded traversal and source filtering.
   • ›Adds SKILLSPECTOR_OUTPUT_LANGUAGE environment variable to set the language of human-readable LLM-generated finding text across discovery analyzers, the meta-analyzer, and MCP tool-poisoning analysis.
   • ›Adds risk_assessment.max_issue_severity field to JSON/SARIF output (value NONE when no active issue is reported) for downstream policy gates.
   • ›Adds bounded local inspection of hidden files and ZIP-compatible nested artifacts (ZIP, DOCX, XLSX, PPTX) without extracting or executing members, raising HIGH SC9 findings for concealed executables.
   • ›Adds EA5 static findings for external model or provider selection, covering silent coding-CLI account switches and top-level model pins.
   +2 moreshow less

   • ›Adds structured skill summaries for valid AISOP/AISP bundles across terminal, Markdown, JSON, and SARIF output formats.
   • ›Adds dynamic analyzer discovery and validates risk-score inputs against the registered analyzer set.
   └──▷ BREAKING ON UPGRADE

   • !langgraph-cli[inmem] is no longer included in the base installation; LangGraph Studio users who install only the base package must now install skillspector[langgraph-dev] explicitly.
4. v2.10.0 Aug 26, 2026 · issue 002

   SkillSpector v2.10.0 adds transitive scanning, hidden/nested artifact inspection, EA5 detection, AISOP/AISP bundle support, and two new output controls.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v2.10.0 https://github.com/NVIDIA/SkillSpector.git
   # already have the repo? check out this version:
   $ git checkout v2.10.0

   └──▷ TRY IT
   Scan a skill and all skills it references transitively, limiting depth and restricting allowed sources, to catch supply-chain risks in referenced dependencies.
   copy

   $ skillspector scan ./my-skill/ --transitive --transitive-depth 2 --transitive-allow-prefix https://github.com/trusted-org/

   Run a scan with finding text localized to French, then check the max severity field in the JSON report to gate a CI pipeline.
   copy

   $ SKILLSPECTOR_OUTPUT_LANGUAGE=French skillspector scan ./my-skill/ --format json --output report.json && jq '.risk_assessment.max_issue_severity' report.json

   • ›Adds --transitive flag to opt into transitive scanning of referenced skills, with --transitive-depth, --transitive-allow-prefix, and --transitive-deny-prefix controls for bounded traversal and source filtering.
   • ›Adds SKILLSPECTOR_OUTPUT_LANGUAGE environment variable to set the language of human-readable LLM-generated finding text across discovery analyzers, the meta-analyzer, and MCP tool-poisoning analysis.
   • ›Adds risk_assessment.max_issue_severity field to JSON/SARIF output (value NONE when no active issue is reported) for downstream policy gates.
   • ›Adds bounded local inspection of hidden files and ZIP-compatible nested artifacts (ZIP, DOCX, XLSX, PPTX) without extracting or executing members, raising HIGH SC9 findings for concealed executables.
   • ›Adds EA5 static findings for external model or provider selection, covering silent coding-CLI account switches and top-level model pins.
   +2 moreshow less

   • ›Adds structured skill summaries for valid AISOP/AISP bundles across terminal, Markdown, JSON, and SARIF output formats.
   • ›Adds dynamic analyzer discovery and validates risk-score inputs against the registered analyzer set.
   └──▷ BREAKING ON UPGRADE

   • !langgraph-cli[inmem] is no longer included in the base installation; LangGraph Studio users who install only the base package must now install skillspector[langgraph-dev] explicitly.
5. v2.9.5 Aug 15, 2026 · issue 005

   SkillSpector v2.9.5 adds Ollama, Azure OpenAI, and OpenAI-compatible providers, opt-in .skillspector-baseline.yaml discovery, and deserialization detection.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v2.9.5 https://github.com/NVIDIA/SkillSpector.git
   # already have the repo? check out this version:
   $ git checkout v2.9.5

   └──▷ TRY IT
   Let SkillSpector auto-discover the committed baseline so CI suppresses known findings without an explicit flag.
   copy

   $ skillspector baseline ./my-skill/ -o .skillspector-baseline.yaml
   # commit .skillspector-baseline.yaml to the repo root, then in CI:
   skillspector scan ./my-skill/

   • ›Adds opt-in automatic discovery of a top-level .skillspector-baseline.yaml file; explicitly supplied baselines via --baseline remain authoritative.
   • ›Adds Ollama support for local OpenAI-compatible inference, Azure OpenAI deployment routing, and a configurable provider for other OpenAI-compatible endpoints via SKILLSPECTOR_PROVIDER.
   • ›Adds static analysis coverage for insecure deserialization patterns surfaced as AST10, TT6, and DS1–DS4 findings.
   • ›Uses byte offsets when mapping YARA matches back to source lines so non-ASCII content in scanned files is reported at accurate locations.
   • ›Scopes the destructive-autonomy YARA post-filter to SkillSpector's built-in rule namespace, preventing custom YARA rules that reuse a built-in rule name from being incorrectly post-filtered.
6. v2.9.5 Aug 15, 2026 · issue 002

   SkillSpector v2.9.5 adds Ollama, Azure OpenAI, and OpenAI-compatible providers, opt-in .skillspector-baseline.yaml discovery, and deserialization detection.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v2.9.5 https://github.com/NVIDIA/SkillSpector.git
   # already have the repo? check out this version:
   $ git checkout v2.9.5

   └──▷ TRY IT
   Let SkillSpector auto-discover the committed baseline so CI suppresses known findings without an explicit flag.
   copy

   $ skillspector baseline ./my-skill/ -o .skillspector-baseline.yaml
   # commit .skillspector-baseline.yaml to the repo root, then in CI:
   skillspector scan ./my-skill/

   • ›Adds opt-in automatic discovery of a top-level .skillspector-baseline.yaml file; explicitly supplied baselines via --baseline remain authoritative.
   • ›Adds Ollama support for local OpenAI-compatible inference, Azure OpenAI deployment routing, and a configurable provider for other OpenAI-compatible endpoints via SKILLSPECTOR_PROVIDER.
   • ›Adds static analysis coverage for insecure deserialization patterns surfaced as AST10, TT6, and DS1–DS4 findings.
   • ›Uses byte offsets when mapping YARA matches back to source lines so non-ASCII content in scanned files is reported at accurate locations.
   • ›Scopes the destructive-autonomy YARA post-filter to SkillSpector's built-in rule namespace, preventing custom YARA rules that reuse a built-in rule name from being incorrectly post-filtered.
7. v2.9.4 Aug 13, 2026 · issue 005

   SkillSpector v2.9.4 adds whitespace-padding prompt-injection detection and Python bytecode supply-chain findings (SC8).

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v2.9.4 https://github.com/NVIDIA/SkillSpector.git
   # already have the repo? check out this version:
   $ git checkout v2.9.4

   • ›Adds detection for whitespace-padding techniques used to conceal prompt-injection instructions inside skill content.
   • ›Adds a HIGH-severity SC8 finding when a skill ships Python bytecode or __pycache__ content, expanding supply-chain coverage.
   • ›Recognises allowed-tools as valid least-privilege permission guidance in remediations and documentation.
   • ›Ships a Skill Inspector companion skill guide.
   └──▷ BREAKING ON UPGRADE

   • !HTTP MCP clients can no longer scan local filesystem paths or supply local YARA-rule directories; use a remote repository or URL for HTTP requests, or use stdio transport for local scans.
8. v2.9.4 Aug 13, 2026 · issue 002

   SkillSpector v2.9.4 adds whitespace-padding prompt-injection detection and Python bytecode supply-chain findings (SC8).

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v2.9.4 https://github.com/NVIDIA/SkillSpector.git
   # already have the repo? check out this version:
   $ git checkout v2.9.4

   • ›Adds detection for whitespace-padding techniques used to conceal prompt-injection instructions inside skill content.
   • ›Adds a HIGH-severity SC8 finding when a skill ships Python bytecode or __pycache__ content, expanding supply-chain coverage.
   • ›Recognises allowed-tools as valid least-privilege permission guidance in remediations and documentation.
   • ›Ships a Skill Inspector companion skill guide.
   └──▷ BREAKING ON UPGRADE

   • !HTTP MCP clients can no longer scan local filesystem paths or supply local YARA-rule directories; use a remote repository or URL for HTTP requests, or use stdio transport for local scans.
9. v2.5.2 Aug 4, 2026 · issue 005

   SkillSpector v2.5.2 adds MCP registry posture scanning and enforces bounded ingest limits for URLs, archives, and Git repos.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v2.5.2 https://github.com/NVIDIA/SkillSpector.git
   # already have the repo? check out this version:
   $ git checkout v2.5.2

   • ›Adds MCP registry posture scanning via skillspector mcp (install with the mcp extra: skillspector[mcp]).
   • ›Enforces INGEST_MAX_BYTES (100 MiB per-ingest cap) and INGEST_MAX_ZIP_MEMBERS (10,000 entries) for streamed URL downloads, zip archives, and Git repository clones, failing closed with IngestLimitExceededError on breach.
10. v2.5.2 Aug 4, 2026 · issue 002

    SkillSpector v2.5.2 adds MCP registry posture scanning and enforces bounded ingest limits for URLs, archives, and Git repos.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v2.5.2 https://github.com/NVIDIA/SkillSpector.git
    # already have the repo? check out this version:
    $ git checkout v2.5.2

    • ›Adds MCP registry posture scanning via skillspector mcp (install with the mcp extra: skillspector[mcp]).
    • ›Enforces INGEST_MAX_BYTES (100 MiB per-ingest cap) and INGEST_MAX_ZIP_MEMBERS (10,000 entries) for streamed URL downloads, zip archives, and Git repository clones, failing closed with IngestLimitExceededError on breach.
11. v2.5.1 Jul 31, 2026 · issue 005

    SkillSpector v2.5.1 adds SKILLSPECTOR_MAX_LLM_CONCURRENCY to throttle async LLM batch requests for rate-limited providers.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v2.5.1 https://github.com/NVIDIA/SkillSpector.git
    # already have the repo? check out this version:
    $ git checkout v2.5.1

    └──▷ TRY IT
    Serialize LLM analyzer requests to avoid bursting a rate-limited provider such as one with a strict requests-per-minute cap.
    copy

    $ SKILLSPECTOR_MAX_LLM_CONCURRENCY=1 skillspector scan ./my-skill/

    Persist a reduced concurrency limit for all scans run in a Docker-based workflow by adding it to your .env file.
    copy

    $ SKILLSPECTOR_PROVIDER=anthropic
    ANTHROPIC_API_KEY=sk-ant-...
    SKILLSPECTOR_MAX_LLM_CONCURRENCY=3

    • ›Adds SKILLSPECTOR_MAX_LLM_CONCURRENCY environment variable to configure the default async LLM batch concurrency; blank or invalid values retain the default of 10, and values below 1 clamp to 1.
12. v2.5.1 Jul 31, 2026 · issue 002

    SkillSpector v2.5.1 adds SKILLSPECTOR_MAX_LLM_CONCURRENCY to throttle async LLM batch requests for rate-limited providers.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v2.5.1 https://github.com/NVIDIA/SkillSpector.git
    # already have the repo? check out this version:
    $ git checkout v2.5.1

    └──▷ TRY IT
    Serialize LLM analyzer requests to avoid bursting a rate-limited provider such as one with a strict requests-per-minute cap.
    copy

    $ SKILLSPECTOR_MAX_LLM_CONCURRENCY=1 skillspector scan ./my-skill/

    Persist a reduced concurrency limit for all scans run in a Docker-based workflow by adding it to your .env file.
    copy

    $ SKILLSPECTOR_PROVIDER=anthropic
    ANTHROPIC_API_KEY=sk-ant-...
    SKILLSPECTOR_MAX_LLM_CONCURRENCY=3

    • ›Adds SKILLSPECTOR_MAX_LLM_CONCURRENCY environment variable to configure the default async LLM batch concurrency; blank or invalid values retain the default of 10, and values below 1 clamp to 1.
13. v2.5.0 Jul 27, 2026 · issue 005

    SkillSpector v2.5.0 adds inspection-ledger accounting with execution_successful and analysis_completeness.ledger_exceptions fields in JSON/SARIF output, plus exit code 2 for fatal failures.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v2.5.0 https://github.com/NVIDIA/SkillSpector.git
    # already have the repo? check out this version:
    $ git checkout v2.5.0

    └──▷ TRY IT
    Gate CI on scan completeness — block pipelines where the scan itself failed, not just where findings were found.
    copy

    $ skillspector scan ./my-skill/ --format json --output report.json; python3 -c "import json,sys; r=json.load(open('report.json')); sys.exit(1 if not r.get('execution_successful') else 0)"

    After upgrading, regenerate a version 2 baseline so fingerprints bind to the new scanner version before committing.
    copy

    $ skillspector baseline ./my-skill/ -o .skillspector-baseline.yaml

    • ›Adds execution_successful top-level status field and analysis_completeness.ledger_exceptions diagnostics to JSON output, letting automation distinguish a complete scan from a partial or failed one.
    • ›CLI now exits with code 2 for a fatal execution or accounting failure, even when a JSON report was produced — enabling fail-closed CI gates.
    • ›Adds canonical inspection-ledger accounting across static and LLM analysis stages, with per-component coverage and explicit out-of-scope records in JSON and SARIF output.
    • ›Regenerate baselines using skillspector baseline <path> to produce version 2 fingerprints, which bind accepted findings to the scanner version, source content, and full finding evidence.
    • ›Recursive scans now propagate child scan failures into the combined report and return a non-zero exit when any child fails.
    └──▷ BREAKING ON UPGRADE

    • !Baseline files containing version 1 fingerprints are rejected on upgrade. Run skillspector baseline <path>, review the generated version 2 entries, and commit the replacement; rules-only version 1 baselines remain supported with a warning.
    • !JSON integrations must now treat invalid or missing output, a nonzero process exit, or execution_successful: false as a blocking validation error and surface analysis_completeness.ledger_exceptions for diagnosis.
14. v2.5.0 Jul 27, 2026 · issue 002

    SkillSpector v2.5.0 adds inspection-ledger accounting with execution_successful and analysis_completeness.ledger_exceptions fields in JSON/SARIF output, plus exit code 2 for fatal failures.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v2.5.0 https://github.com/NVIDIA/SkillSpector.git
    # already have the repo? check out this version:
    $ git checkout v2.5.0

    └──▷ TRY IT
    Gate CI on scan completeness — block pipelines where the scan itself failed, not just where findings were found.
    copy

    $ skillspector scan ./my-skill/ --format json --output report.json; python3 -c "import json,sys; r=json.load(open('report.json')); sys.exit(1 if not r.get('execution_successful') else 0)"

    After upgrading, regenerate a version 2 baseline so fingerprints bind to the new scanner version before committing.
    copy

    $ skillspector baseline ./my-skill/ -o .skillspector-baseline.yaml

    • ›Adds execution_successful top-level status field and analysis_completeness.ledger_exceptions diagnostics to JSON output, letting automation distinguish a complete scan from a partial or failed one.
    • ›CLI now exits with code 2 for a fatal execution or accounting failure, even when a JSON report was produced — enabling fail-closed CI gates.
    • ›Adds canonical inspection-ledger accounting across static and LLM analysis stages, with per-component coverage and explicit out-of-scope records in JSON and SARIF output.
    • ›Regenerate baselines using skillspector baseline <path> to produce version 2 fingerprints, which bind accepted findings to the scanner version, source content, and full finding evidence.
    • ›Recursive scans now propagate child scan failures into the combined report and return a non-zero exit when any child fails.
    └──▷ BREAKING ON UPGRADE

    • !Baseline files containing version 1 fingerprints are rejected on upgrade. Run skillspector baseline <path>, review the generated version 2 entries, and commit the replacement; rules-only version 1 baselines remain supported with a warning.
    • !JSON integrations must now treat invalid or missing output, a nonzero process exit, or execution_successful: false as a blocking validation error and surface analysis_completeness.ledger_exceptions for diagnosis.