skillspector — Agent Guide

No conflict-matrix pairs for this tool yet.

# SkillSpector — Agent Guide

name: skillspector ｜ version_range: 2.10.0~2.10.0 ｜ generated: 2026-08-28

title_en: SkillSpector - AI Agent Skill Security Scanner (NVIDIA) ｜ desc_en: Scans skills before install for vulnerabilities, malicious patterns and unsafe configurations.

Preflight

note: Requires Python >= 3.10.

python3 --version

预期输出: see command output

Install

note: Tsinghua mirror recommended in mainland China.

pip install -i https://pypi.tuna.tsinghua.edu.cn/simple skillspector==2.10.0
skillspector --version

预期输出: 2.10.0（无 --version 标志时以 --help 为准）

Operations

Static scan of a skill directory (--no-llm)

note: Verified in this environment; API key not required.

skillspector scan ./skills/my-skill --no-llm

预期输出: SkillSpector Security Report（Score/Severity/Components/Issues 清单，含 SC2 外部脚本拉取、TM2 工具链滥用等检出）

Scan with LLM semantic analysis

note: Requires OPENAI_API_KEY or SKILLSPECTOR_PROVIDER; auto-skips with warning when key missing.

skillspector scan ./skills/my-skill

预期输出: 静态 + 语义分析报告（semantic_developer_intent/quality_policy/security_discovery 分析器；无 key 时自动跳过并警告）

Scan a Git repository/URL/zip

note: Officially supported; not tested.

skillspector scan https://github.com/owner/repo

预期输出: 同报告格式（Source 显示远端地址）

Run as an MCP server

note: Official form; not tested.

skillspector mcp

预期输出: MCP server 启动（供 agent 工具调用）

Uninstall

note: Idempotent pip uninstall; zero write surface.

pip uninstall -y skillspector 2>/dev/null || true
command -v skillspector >/dev/null 2>&1 && echo '残留: skillspector 仍存在' || echo 'skillspector removed: OK'

预期输出: skillspector removed: OK

Facts

writes: none (read-only scanner) ｜ runtime: Python >= 3.10, pip ｜ notes: read-only scan, no background process; LLM analysis optional, key-free with --no-llm

Source: skillspector · validated 2026-08-28 · v2.10.0~2.10.0

← Agent index