Theme
AI Resources
SkillSpector
SkillSpector is NVIDIA's public scanner for AI agent skills, built for checking skill folders, files, repositories, URLs, and zip packages before people wire them into coding-agent workflows.
The README lists 68 vulnerability patterns across 17 categories, fast static analysis, optional LLM semantic evaluation, OSV.dev dependency lookups, terminal / JSON / Markdown / SARIF output, and Python 3.12+ setup through uv or pip. Use this as a first read, not a recommendation. Open the original project before trusting details like terms, limits, privacy, cost, setup, or safety.
What it is
Scanner for agent skills
SkillSpector is a command-line and LangGraph-based workflow for inspecting AI agent skill packages, including single SKILL.md files, local directories, zip files, URLs, and Git repositories.
Why it stands out
Agent-skill checks, not generic linting
The rule list is tuned to agent-skill problems such as prompt injection, data exfiltration, privilege escalation, tool misuse, memory poisoning, MCP least privilege, MCP tool poisoning, executable code, and dependency issues.
Availability
Repo, CLI, and report formats
The repository includes install instructions, scan commands, provider settings for optional LLM analysis, a development guide, tests, and report output paths for terminal, JSON, Markdown, and SARIF use.
Why it matters
What makes it useful
Reusable agent skills can carry instructions, tool behavior, dependencies, and risk patterns that are easy to miss by name alone. Its static checks, optional LLM review, OSV lookup, and report outputs give readers a concrete skill-inspection layer to compare.
What to know
Where it fits
Open it beside agent-skill catalogs and skill-building projects. The resource is less about creating a new skill and more about checking what a skill contains, how it behaves on paper, and what a report can surface for review.
Notable points
What stands out
The repository exposes the full inspection path: accepted inputs, static analyzers, optional LLM evaluation, OSV lookups, report formats, and known limitations. Its output supports human review; it is not a safety guarantee or a sandbox.
Before using
What to review
Which input style fits the workflow: local skill folder, single SKILL.md file, Git URL, regular URL, or zip file.
Whether to run static-only mode or configure the optional LLM analysis with OpenAI, Anthropic, NVIDIA build, or a local OpenAI-compatible endpoint.
How JSON, Markdown, or SARIF reports should be stored if they include snippets from private skill files or internal workflow code.
Which findings need human review before changing, rejecting, or publishing a skill.
Reader fit
Who may find it relevant
Builders trying agent skills across Claude Code, Codex CLI, Gemini CLI, or similar skills-aware tools.
Teams organizing reusable skills and wanting a report format that can fit local review, documentation, or CI workflows.
Less relevant for readers looking only for model releases, consumer chat apps, or general-purpose coding assistants.
Editorial note
Why LifeHubber lists it
LifeHubber lists SkillSpector because it turns agent-skill inspection into concrete artifacts: 68 patterns across 17 categories, optional semantic evaluation, dependency lookups, and terminal, JSON, Markdown, or SARIF reports that people can review or carry into CI.
Source links
Source materials
Reader note
Before relying on this entry
LifeHubber lists entries to help readers inspect AI projects, not to endorse them or prove they are safe, suitable, accurate, maintained, or right for a specific use. We do not verify every entry in depth. Before relying on anything listed, review the original materials, terms, privacy practices, limits, and risks that matter for your situation.
What to explore next
Move from finding a skill to deciding what it may do.
After scanning a skill, decide how resources are discovered, which later actions need runtime policy checks, and where a person must approve or stop computer control.
More in AI Agents
Keep browsing this category
A few more places to continue in ai agents.
Agent-Reach
Panniantong/Agent-Reach
A CLI and channel-routing layer for command-capable agents, with documented paths for web pages, YouTube, RSS, GitHub, Twitter/X, Reddit, Bilibili, Xiaohongshu, Facebook, Instagram, LinkedIn, V2EX, Xueqiu, podcasts, and Exa search, plus doctor checks and safe/dry-run install review.
AIPOCH Medical Research Skills
aipoch/medical-research-skills
A curated library of medical research agent skills designed to support evidence review, protocol design, data analysis, and academic writing workflows.
Claude Code Game Studios
Donchitos/Claude-Code-Game-Studios
A multi-agent game-development studio system for Claude Code, organized around specialized agents, workflow skills, hooks, rules, and templates.
Related in LifeHubber
Keep the thread going
Follow the next layer with AI Resources for AI projects with original links and practical caveats, AI Guides for decision habits for messy AI choices, AI Access for free and low-cost ways to compare AI model access, AI Ballot for a clearer view of what readers are leaning toward, and AI Radar for AI stories that deserve a second look.