NVIDIA/SkillSpector
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
Build with Backblaze B2
SDKs, agent skills, IDE extensions, and reference pipelines from Backblaze Labs. All open source.
Loading star history...
Where it stands
Rank, growth pace and release cadence relative to everything GStars tracks.
Ranks #153 of 2,794 repositories GStars tracks this week (top 5%).
5 releases in the last 90 days, the latest 2 days ago, with 102 contributors on GitHub.
Peaked at #16 in the weekly ranking the week of Jul 12, its best in the past year.
Use Cases & Benefits
- Detects security vulnerabilities, malicious patterns, and risks in AI agent skills before installation using static and optional LLM semantic analysis.
- Provides comprehensive multi-format scanning with live vulnerability lookups and detailed risk scoring to prevent unsafe AI skill deployment.
- Use for vetting AI agent skills in Claude Code, Codex, or MCP environments to ensure safe integration before installation.
- Use for continuous security auditing of AI skill repositories and supply chains to identify known CVEs and malicious code patterns.
- Use for integrating automated security scans into CI/CD pipelines with SARIF output to enforce safe AI skill development workflows.
Should you depend on it?
License terms, project hygiene and risks, from GitHub metadata and GStars' snapshots.
License
Apache 2.0
Permissive: commercial use, modification and redistribution are allowed with attribution; includes an explicit patent grant from contributors.
Community files
- README: present
- Contributing guide: present
Watch-outs
No watch-outs from GStars' checks.
General guidance from repository metadata, not legal advice. How we score
From the README
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills.
AI agent skills (used by Claude Code, Codex CLI, Gemini CLI, etc.) execute with implicit trust and minimal vetting. Research shows that 26.1% of skills contain vulnerabilities and 5.2% show likely malicious intent.
SkillSpector helps you answer: "Is this skill safe to install?"
Daily snapshots
Stars gained per day, and how forks and open issues moved, from GStars' daily snapshots
+6,649 stars over 84 days across 45 snapshot days; best day +191 on Sep 9.
Forks
1.8K+658
Open issues
160+68
Compared with peers in AI Agents
Fastest-growing repositories GStars tracks in this cohort for the week of Oct 18, by 7-day star growth
| Repository | Stars | +7d | Health | Last release |
|---|---|---|---|---|
| morluto/rea | 366.3K | +106.3K | 60 | 4 days ago |
| stablyai/orca | 102.8K | +9.4K | 60 | 1 day ago |
| DietrichGebert/ponytail | 173.5K | +9.2K | 75 | 6 days ago |
| Leonxlnx/taste-skill | 101.1K | +4.0K | 75 | 2 days ago |
| ruvnet/ruflo | 78.5K | +3.7K | 40 | today |
| NVIDIA/SkillSpector | 20.5K | +0 | 75 | 2 days ago |
| Category median | 102.8K | +9.2K | 60 | — |
Also by NVIDIA
Other repositories from this maintainer that GStars tracks
- TypeScript22.7K stars
NemoClaw
Run agents like Hermes, LangChain Deep Agents, and OpenClaw more securely inside NVIDIA OpenShell with managed inference
- Python18.1K stars
Megatron-LM
Ongoing research training transformer models at scale
- Rust17.8K stars
OpenShell
OpenShell is the safe, private runtime for autonomous AI agents.
- Python14.9K stars
TensorRT-LLM
TensorRT LLM provides users with an easy-to-use Python API to define Large Language Models (LLMs) and supports state-of-the-art optimizations to perform inference efficiently on NVIDIA GPUs. TensorRT LLM also contains components to create Python and C++ runtimes that orchestrate the inference execution in a performant way.
- 12.1K stars
cosmos
NVIDIA Cosmos is an open platform of world models, datasets, and tools that enables developers to build Physical AI for robots, autonomous vehicles, smart infrastructure, and more.
Discover Repositories
Search across tracked repositories by name or description