SkillSpector
Scanner that checks AI agent skills for security risks before install
What it is
A command-line scanner that inspects agent skills for Claude Code, Codex, Gemini CLI, and MCP servers, looking for injected prompts, attempts to leak data or gain elevated privileges, risky dependencies, and dangerous code. It combines static analysis, YARA signatures, and taint tracking with an optional LLM review, then produces a 0-100 risk score with terminal, JSON, Markdown, or SARIF reports. Developers and security teams run it on Git repos, zip files, or directories to decide whether a skill is safe to add, or wire it into CI to gate installs.