| name | skillspector |
| description | Use NVIDIA SkillSpector to scan Codex, Claude Code, Gemini CLI, or other agent skills for security risks before installing or trusting them. |
| metadata | {"source":"https://github.com/NVIDIA/SkillSpector","local-tool":"/Users/Dario/.codex/tools/skillspector/.venv/bin/skillspector"} |
SkillSpector
Use this skill when evaluating, installing, auditing, or repairing an AI agent skill and the user needs a security scan.
Local Tool
SkillSpector is installed as a local CLI tool here:
/Users/Dario/.codex/tools/skillspector/.venv/bin/skillspector
The source checkout is here:
/Users/Dario/.codex/tools/skillspector
Default Scan
Prefer static scanning first so no model credentials are required:
/Users/Dario/.codex/tools/skillspector/.venv/bin/skillspector scan /path/to/skill --no-llm
For a machine-readable report:
/Users/Dario/.codex/tools/skillspector/.venv/bin/skillspector scan /path/to/skill --no-llm --format json --output /path/to/report.json
LLM Scan
Only run LLM analysis when the user explicitly wants it or the static report needs semantic review. Confirm which provider/key should be used before invoking an LLM scan.
Output Discipline
Summarize:
- risk score and recommendation
- critical/high findings
- exact files and line references when available
- whether the result is static-only or LLM-assisted
- remaining false-positive or coverage risk
