SkillSpector: scanner for AI agent skills
SkillSpector scans AI agent skills before you install them. It reads Git repos, URLs, zips, directories, and files. Apache 2.0.
Key features
- Scans Git repositories, URLs, zip files, directories, or a single file
- Runs static checks and can add optional LLM semantic analysis
- Writes terminal, JSON, Markdown, or SARIF reports
- Looks up known vulnerable dependencies on OSV.dev, with an offline fallback
- Installs from a git clone into a virtual environment, then make install
- README lists Python 3.12 or newer
- Can run as an MCP server so a local agent can scan a skill before install
- Licensed under the Apache License 2.0
- Category
- Dev Tools
- Who it's for
- Developers reviewing an AI agent skill before they install it.
- Tags
- securityagentterminallocal-inferencetool-callingpythonpackage-managerversion-controlnotes-docs
- Website
- github.com
- Listed
- 2026-10-23
Frequently asked questions
Is SkillSpector free?
Yes. SkillSpector is open source and free to use.
What is SkillSpector used for?
Security scanner for AI agent skills. It scans Git repos, URLs, zip files, directories, and single files. Apache 2.0. Typical uses: scans Git repositories, URLs, zip files, directories, or a single file; runs static checks and can add optional LLM semantic analysis; writes terminal, JSON, Markdown, or SARIF reports.
What are the best SkillSpector alternatives?
Alternatives in the same category include Agent Toolkit for AWS, WordCraft, Notion, Security Audit Skill, GridCraft.
Related in Dev Tools
See all →- Security Audit Skill Coding-agent skill for a six-phase security audit with machine-readable findings and independent verification. MIT.
- Apache Caldera Open-source cybersecurity framework for automated adversary emulation and security assessments.
- Agent Toolkit for AWS Gives your coding agent the tools, knowledge, and guardrails to build production-ready infrastructure on AWS.
- Astro Web framework for content sites, with islands of client JavaScript.
- Biome Formatter and linter for JavaScript and TypeScript.
- Bun JavaScript runtime, bundler, and package manager.
