Theme
AI Resources
SkillSpector
SkillSpector is NVIDIA's public scanner for AI agent skills, built for checking skill folders, files, repositories, URLs, and zip packages before people wire them into coding-agent workflows.
The README lists 71 vulnerability patterns across 17 categories, fast static analysis, optional LLM semantic evaluation, OSV.dev dependency lookups, terminal / JSON / Markdown / SARIF output, and Python 3.12+ setup through uv or pip. Use this as a first read, not a recommendation. Open the original project before trusting details like terms, limits, privacy, cost, setup, or safety.
What it is
Scanner for agent skills
SkillSpector is a command-line and LangGraph-based workflow for inspecting AI agent skill packages, including single SKILL.md files, local directories, zip files, URLs, and Git repositories.
Why it stands out
Agent-skill checks, not generic linting
The rule list is tuned to agent-skill problems such as prompt injection, data exfiltration, privilege escalation, tool misuse, memory poisoning, MCP least privilege, MCP tool poisoning, executable code, and dependency issues.
Availability
Repo, CLI, and report formats
The repository includes install instructions, scan commands, provider settings for optional LLM analysis, tests, and report outputs that distinguish completed analysis from skipped or failed checks.
Why it matters
What makes it useful
Reusable agent skills can carry instructions, tool behavior, dependencies, and risk patterns that are easy to miss by name alone. Its static checks, optional LLM review, OSV lookup, and report outputs give readers a concrete skill-inspection layer to compare.
What to know
Where it fits
Open it beside agent-skill catalogs and skill-building projects. The resource is less about creating a new skill and more about checking what a skill contains, how it behaves on paper, and what a report can surface for review.
Notable points
What stands out
Reports include analysis-completeness information so automated checks can distinguish ordinary findings from a scan that skipped or failed work. The output supports human review; it is not a safety guarantee or a sandbox.
Before using
What to review
Which input style fits the workflow: local skill folder, single SKILL.md file, Git URL, regular URL, or zip file.
Whether to run static-only mode or configure the optional LLM analysis with OpenAI, Anthropic, NVIDIA build, or a local OpenAI-compatible endpoint.
How JSON, Markdown, or SARIF reports should be stored if they include snippets from private skill files or internal workflow code.
Which findings need human review before changing, rejecting, or publishing a skill.
Whether the report says analysis completed successfully; a zero-finding result is not enough if checks were skipped or failed.
Reader fit
Who may find it relevant
Builders trying agent skills across Claude Code, Codex CLI, Gemini CLI, or similar skills-aware tools.
Teams organizing reusable skills and wanting a report format that can fit local review, documentation, or CI workflows.
Less relevant for readers looking only for model releases, consumer chat apps, or general-purpose coding assistants.
Editorial note
Why LifeHubber lists it
SkillSpector turns agent-skill inspection into reviewable evidence: 71 patterns across 17 categories, optional semantic evaluation, dependency lookups, multiple report formats, and completeness records that show when checks did not run successfully.
Source links
Source materials
Reader note
Before relying on this entry
LifeHubber lists entries to help readers inspect AI projects, not to endorse them or prove they are safe, suitable, accurate, maintained, or right for a specific use. We do not verify every entry in depth. Before relying on anything listed, review the original materials, terms, privacy practices, limits, and risks that matter for your situation.
What to explore next
Move from finding a skill to deciding what it may do.
After scanning a skill, decide how resources are discovered, which later actions need runtime policy checks, and where a person must approve or stop computer control.
More in AI Agents
Keep browsing this category
Explore more AI agent projects.
Paperclip
paperclipai/paperclip
A self-hosted server and dashboard for coordinating agent teams through companies, goals, roles, issues, heartbeats, budgets, approvals, and persistent activity records.
Ponytail
DietrichGebert/ponytail
An MIT-licensed instruction and plugin pack that steers coding agents toward understanding the task, reusing existing code and native features, and writing the smallest solution needed, with rules that tell agents not to simplify away validation, security, data-loss handling, or accessibility.
MolmoWeb
allenai/molmoweb
A multimodal web agent from Ai2 that can navigate browser tasks from natural-language instructions.
For project maintainers
Listed here? You can use the badge.
If you maintain a project with a current LifeHubber listing, you may add the optional “Listed on LifeHubber AI Resources” badge to its README, docs, or website. No introduction or permission request is needed.
