Does SkillSpector use paid AI services?

Can use OpenAI, Anthropic or Azure OpenAI. Its settings have keys for these paid APIs. Its README says whether one is required.

Is SkillSpector still maintained?

Yes, active. Last change today. Latest release v2.13.4, 7 days ago.

Can I trust SkillSpector?

Some track record. 25k stars, 8 months old, by an organization. Get it from the official repo and read what it installs.

How to install on Windows

NVIDIA/SkillSpector

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.

Node.jsPython#agent-security#agent-skills#agentic-ai#ai-security

Before you start

Is it free?: YesOpen source (Apache-2.0).
Paid AI services?: Can use OpenAI, Anthropic or Azure OpenAIIts settings have keys for these paid APIs. Its README says whether one is required.
Still maintained?: Yes, activeLast change today. Latest release v2.13.4, 7 days ago.
Can I trust it?: Some track record25k stars, 8 months old, by an organization. Get it from the official repo and read what it installs.

Difficulty: Moderate
Time: 30 min or more
Stars: ★ 25,425
Activity: Updated this month

Saved setup from just now

Will it work on Windows?

Yes, it installs on your Windows

The README gives a pipx / uv install for Windows.

Your system

macOS Windows Linux

Start here

Website ↗docs.nvidia.comThe project's own site.

Heads-upBuilding it yourself? It also needs 25 settings in .env (6 secret).

Install with a package manager

pipx / uv

uv tool install git+https://github.com/NVIDIA/skillspector.git

pipx / uv

uv tool install 'skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git'

pipx / uv

uv tool install --force 'skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git'

From the README, exactly as the maintainers wrote it.

Did you get it running?

No reports for Windows yet.

Still stuck? Get a written guide

GitManual AI Agent reads the 12 key files and writes a step-by-step guide for Windows. Once written, it's saved for everyone.

Parts list

1×Node.js LTS (no version pinned)runtime
1×Python >=3.12,<3.16runtime
1×Docker tool
1×make tool
1×npm package manager
1×uv package manager

25× settings in .env

ENV
SKILLSPECTOR_PROVIDER
NVIDIA_INFERENCE_KEYsecret
OPENAI_API_KEYsecret
OPENAI_BASE_URL
SKILLSPECTOR_REASONING_EFFORToptional
SKILLSPECTOR_OUTPUT_LANGUAGEoptional
SKILLSPECTOR_TEMPERATUREoptional
SKILLSPECTOR_SEEDoptional
ANTHROPIC_API_KEYsecret
ANTHROPIC_PROXY_ENDPOINT_URL
ANTHROPIC_PROXY_API_KEYsecret
GOOGLE_CLOUD_PROJECT
AZURE_OPENAI_API_KEYsecret
AZURE_OPENAI_ENDPOINT
SKILLSPECTOR_COMPAT_API_KEYsecret
SKILLSPECTOR_COMPAT_BASE_URL
SKILLSPECTOR_MODEL
SKILLSPECTOR_LOG_LEVELoptional
LANGCHAIN_TRACING_V2optional
LANGCHAIN_API_KEYsecretoptional
LANGCHAIN_WORKSPACEoptional
LANGCHAIN_PROJECToptional
LANGCHAIN_ENDPOINToptional
SKILLSPECTOR_API_KEYSsecretoptional

Share this manual

Is this your repo?

Add a badge to your README so newcomers find these steps.

[![Setup manual](https://gitmanual.com/NVIDIA/SkillSpector/badge.svg)](https://gitmanual.com/NVIDIA/SkillSpector)

Good to know

Dockerfile available (base image: python:3.12-slim-bookworm@sha256:8a7e7cc04fd3e2bd787f7f24e22d5d119aa590d429b50c95dfe12b3abe52f48b).
Makefile has a make install target — it may automate most of these steps.

Details

License: Apache-2.0
Open issues: 148
Branch: main

Files we read (12)

.env.example

.github/workflows/ci.yml

.github/workflows/release.yml

.github/workflows/scorecard.yml

.github/workflows/update-pr-branches.yml

Dockerfile

Makefile

README.md

contrib/batch_scan/.env.example

docs/DEVELOPMENT.md

package.json

pyproject.toml

554 files in the repo

Yes, it installs on your Windows

Start here

Install with a package manager

Did you get it running?

Still stuck? Get a written guide

More like SkillSpector that run on Windows