Scan agent skills before installation with SkillSpector
Use SkillSpector to scan Claude Code, Codex, Gemini, MCP, and other agent skills for vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risk before installation.
npx skills add agentskillexchange/skills --skill scan-agent-skills-before-installation-with-skillspector
# Scan agent skills before installation with SkillSpector
What this skill actually does
Use this skill when an operator needs to decide whether an agent skill is safe to install. SkillSpector scans Git repositories, URLs, zip files, directories, or individual SKILL.md files and reports security findings across vulnerability, malicious-pattern, prompt-injection, data-exfiltration, MCP, and supply-chain categories.
Invoke this instead of installing a skill normally when the source is new, untrusted, recently changed, or about to enter a shared agent environment. Run a static scan first for fast triage, then add LLM semantic evaluation or MCP/server mode when the operator needs deeper review or an agent-internal scanning tool.
The scope boundary is pre-installation and ongoing security review of agent skills. It is not a generic security product card, a broad vulnerability database, or an SDK listing. The repeatable workflow is: collect the candidate skill source, run SkillSpector against that exact source, review risk scores and findings, then approve, block, or baseline the install.
Source-backed install path from the upstream README: `uv tool install git+https://github.com/NVIDIA/skillspector.git`. For MCP usage, install the MCP extra with `uv tool install ‘skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git’`.
Source-backed invocation examples include `skillspector scan ./my-skill/`, `skillspector scan ./SKILL.md`, and `skillspector scan https://github.com/user/my-skill`.