skillspector

name	skillspector
description	Use NVIDIA SkillSpector to scan Codex, Claude Code, Gemini CLI, or other agent skills for security risks before installing or trusting them.
metadata	{"source":"https://github.com/NVIDIA/SkillSpector","local-tool":"/Users/Dario/.codex/tools/skillspector/.venv/bin/skillspector"}

SkillSpector

Use this skill when evaluating, installing, auditing, or repairing an AI agent skill and the user needs a security scan.

Local Tool

SkillSpector is installed as a local CLI tool here:

/Users/Dario/.codex/tools/skillspector/.venv/bin/skillspector

The source checkout is here:

/Users/Dario/.codex/tools/skillspector

Default Scan

Prefer static scanning first so no model credentials are required:

/Users/Dario/.codex/tools/skillspector/.venv/bin/skillspector scan /path/to/skill --no-llm

For a machine-readable report:

/Users/Dario/.codex/tools/skillspector/.venv/bin/skillspector scan /path/to/skill --no-llm --format json --output /path/to/report.json

LLM Scan

Only run LLM analysis when the user explicitly wants it or the static report needs semantic review. Confirm which provider/key should be used before invoking an LLM scan.

Output Discipline

Summarize:

• risk score and recommendation
• critical/high findings
• exact files and line references when available
• whether the result is static-only or LLM-assisted
• remaining false-positive or coverage risk