菜单
Scan AI agent skill files for security vulnerabilities before installing. Use when adding third-party skills from npm, GitHub, or marketplace.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
基于 SOC 职业分类
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/TudeOrangBiasa/opencode-workflow --skill skill-spector命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
Shared hosting/cPanel deploy: private artifact repos, local builds, PHP/Laravel symlinks, rollback. Use when deploying to shared hosting without VPS/Docker.
Ask which skill or flow fits your situation. A router over the skills in this repo.
Ultra-compressed communication. Cuts token usage ~75% while keeping technical accuracy. Levels: lite/full/ultra/wenyan. Auto-triggers on efficiency request. Use when user says wenyan-lite, wenyan-full, wenyan-ultra. Use when user says "caveman mode", "talk like caveman", "use caveman", "less tokens", "be brief", or invokes /caveman. Also auto-triggers when token efficiency is requested.
| name | skill-spector |
| description | Scan AI agent skill files for security vulnerabilities before installing. Use when adding third-party skills from npm, GitHub, or marketplace. |
NVIDIA SkillSpector scans AI agent skills (Claude Code, Codex, Gemini, OpenCode) for security risks before installation.
# Install
pip install skillspector
# Scan a skill directory or file
skillspector scan ./path/to/skill/
# Scan a URL (GitHub repo)
skillspector scan https://github.com/owner/repo
# JSON output for agent parsing
skillspector scan ./skill --format json
68 vulnerability patterns across 17 categories: prompt injection, data exfiltration, privilege escalation, supply chain, MCP tool poisoning, etc.
.opencode/skills/ or .config/opencode/skills/Include findings in handoff evidence. Critical findings → block merge.