NVIDIA's free scanner that reads a skill, plugin or MCP server before you install it and flags hidden instructions, data leaks, risky code and known-vulnerable packages, with a 0-100 risk score.
In short: NVIDIA's free scanner that reads a skill, plugin or MCP server before you install it and flags hidden instructions, data leaks, risky code and known-vulnerable packages, with a 0-100 risk score. It is a free skill for people who use Claude Code or Codex and want help with coding agent skills.
Checked on · Added
| Agent / tool | Access / cost | Link |
|---|---|---|
| Claude Code | Paid Claude plan or API | claude.com/claude-code |
| Codex | ChatGPT plan or API | openai.com/codex |
| GitHub repo | Open source · ★ 21.9k | NVIDIA/SkillSpector |
uv tool install git+https://github.com/NVIDIA/skillspector.git uv tool install 'skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git'
Install command copied from the project README. Check the README for the latest version.
NVIDIA's free scanner that reads a skill, plugin or MCP server before you install it and flags hidden instructions, data leaks, risky code and known-vulnerable packages, with a 0-100 risk score.
Give it a GitHub repo, a URL, a zip or a folder and it reads every file of the skill: it looks for 71 known risky patterns (hidden instructions, sending your data out, privilege grabs, poisoned MCP tools, outdated…
Short excerpt from the README of NVIDIA/SkillSpector. Read the full README on GitHub.
Written by us so you can reuse it. Replace each [bracket] with your details.
A clean score is not a guarantee, and a scanner of this kind will also flag normal installer lines; read each finding. The AI pass sends the skill's files to the model provider you pick. Its own repo trips our scanner too because it contains the risky patterns it looks for (we read them: they are detection rules and test samples).
NVIDIA's free scanner that reads a skill, plugin or MCP server before you install it and flags hidden instructions, data leaks, risky code and known-vulnerable packages, with a 0-100 risk score.
It works with Claude Code and Codex. The code is on GitHub at NVIDIA/SkillSpector.
Free & open source (Apache-2.0). The basic scan runs offline; the optional AI review pass uses your own model API key (Anthropic, OpenAI and others), billed by that provider.
Run the install command from the README: “uv tool install git+https://github.com/NVIDIA/skillspector.git”. Check the README on GitHub for the latest version, then follow the steps on this page.
We read 183 instruction and code files and flagged 1 pattern worth a look before installing (often normal for installers): reads SSH keys (in …/skillspector/nodes/analyzers/static_patterns_privilege_escalation.py). Read the flagged lines before you install it.
All credit to the original authors. We rewrite in our own words and link back. Something wrong? Report it.
SKILLYour coding agent connects to an Android or Google TV over Wi-Fi, switches off the ad and tracking apps, and puts in a clean, Apple TV-style home screen. Nothing is uninstalled.
Claude Code +2★ 14.8k
SKILLA Claude skill that reviews a vibecoded screen like a designer: it lists the tell-tale AI touches, proposes a direction from your own product, then fixes spacing, colour, icons, copy, type and layout pass by pass. Works on dashboards, apps, landing pages, or a live site from a link.
Claude Code★ 540
SKILLOne install gives your agent a plan, test, build, review and remember routine, with 71 helper agents, about 300 skills, memory between sessions and a built-in scanner for risky agent settings.
Claude Code +3★ 285.3k
SKILLA skills framework that makes agents brainstorm, plan, test and debug systematically.
Claude Code +1★ 299.2k
SKILLReal engineering skills from a well-known TypeScript educator's own .agents folder.
Claude Code +1★ 291.4k
SKILLA skill that pushes coding agents to act like a lazy senior: fewer lines, more tests, lower cost — without skipping the hard checks.
Claude Code +2★ 164.8kFree newsletter
New AI tools you can use right away, in plain words. Every Friday.