SkillSpector is a security scanner designed to detect vulnerabilities, malicious patterns, and security risks in AI agent skills before installation. The tool addresses a documented problem: research shows that 26.1% of skills contain vulnerabilities and 5.2% exhibit likely malicious intent. AI agent skills, used by platforms like Claude Code, Codex CLI, and Gemini CLI, execute with implicit trust and minimal vetting, making automated security scanning essential.
The scanner implements a two-stage analysis approach combining fast static analysis with optional LLM-based semantic evaluation. It detects 68 distinct vulnerability patterns organized across 17 categories: prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain risks, excessive agency, output handling, system prompt leakage, memory poisoning, tool misuse, rogue agent behavior, trigger abuse, dangerous code via AST analysis, taint tracking, YARA signatures, MCP least privilege violations, and MCP tool poisoning. Each pattern carries severity classifications ranging from low to critical, with specific guidance on what constitutes a violation.
SkillSpector accepts multiple input formats including Git repositories, URLs, zip files, directories, and individual files. It produces output in multiple formats: terminal display, JSON, Markdown, and SARIF reports. The tool generates a risk score from 0 to 100 with severity labels and actionable recommendations. A notable feature is live vulnerability lookups that query OSV.dev for real-time CVE data, with automatic offline fallback capability. The scanner also supports baseline and false-positive suppression through glob-rule or fingerprint-based baselines, allowing users to accept known findings so rescans surface only new issues.
Installation is available via virtual environment with either uv or pip, with Docker support for users without Python installed. The tool can run as a Model Context Protocol server, enabling integration with MCP-capable agents as a runtime guardrail rather than an out-of-band audit step. The MCP server exposes a scan_skill tool that accepts Git URLs, file URLs, zip files, markdown files, or directories and returns structured verdicts including risk scores, severity levels, recommendations, and detailed findings.
LLM analysis can be configured with multiple providers including OpenAI, Anthropic, AWS Bedrock, NVIDIA Build, Claude CLI, and Codex CLI, each with bundled default models. The repository includes comprehensive documentation covering development architecture, package layout, extension mechanisms, and suppression rules. Security considerations for the HTTP transport are documented, noting that the server ships without authentication and requires protective measures like reverse proxies with mTLS when exposed externally.
