Setup
SkillSpector — Check an AI Skill Is Safe Before You Install It
A free security scanner from NVIDIA for Claude Code, Codex and MCP skills. Reads what a skill ships before you install it and gives you a score out of 100 with a plain verdict — safe, caution, or don't.
Free. No email, no signup — the link downloads it.
Stuck on a step? Ask in the community
A skill is a folder of instructions and scripts you drop into an AI assistant to teach it a new job — and once it is installed it runs with your permissions, on your machine, with nobody having checked it first. The research behind this tool scanned 42,447 skills from the major marketplaces: 26.1% carried at least one vulnerability and 5.2% showed likely malicious intent. SkillSpector reads the files before you install, checks 68 known-bad patterns across 17 categories — hidden instructions, API-key harvesting, data sent to outside servers, commands that download and run code — looks every declared dependency up against the live OSV.dev vulnerability database, and hands back a 0–100 score with the file and line number for each finding. It never runs the skill. Free, Apache 2.0, about ten minutes to set up.
What's inside
- The score bands that matter: under 21 is fine, over 50 walk away
- Keep --no-llm on — without it your skill's file contents go to an AI provider on your own paid key
- Two commands to install, plus the reopen-Terminal step that trips up almost everyone
- It is a check, not a shield — what it cannot see, and why a clean score is one signal