Skip to content
Get packs

Skill Inspector

Reviews other AI agent skills for safety before you install them, using a static scanner plus manual source review.

Source Download skill
Repository
NVIDIA/SkillSpector
Stars
23,933
Licence
Apache-2.0
Files
1 file

What it does

Once installed, this skill tells the agent to act as a security reviewer for other agent skills. Before you install or keep a skill, the agent runs NVIDIA's SkillSpector scanner on it (without using an LLM by default), reads the source code and instructions, checks whether the behavior matches the stated purpose, and returns a verdict of APPROVE, CAUTION, or REJECT with the evidence behind it.

Great for

  • Developers who download third-party agent skills and want a safety check first
  • Teams that review skills before adding them to a shared internal library
  • Anyone asking whether a downloaded skill folder looks malicious or over-permissioned

Skip it if

  • Guaranteeing a skill is safe: it is a triage aid, and a static scan plus AI judgment can miss risks (the skill itself says a low score can miss semantic risk)
  • Reviewing skills that need the scanner but where SkillSpector is not installed; the skill says to continue with manual review only, which is slower and less reliable

Try asking

  • “Is this downloaded skill folder safe to install before I add it to Claude?”
  • “Review the skill at this GitHub URL for over-permissioned tools or hidden network calls.”
  • “Check whether this skill's scripts do anything beyond what its description promises.”
Step-by-step guide: how to use Skill InspectorInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.

    skill-inspector.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip skill-inspector.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip skill-inspector.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Give the agent a local path or repository URL; for URLs it clones into a temporary directory before review.
  • Ask for the full report if you want the rule IDs and file and line evidence, not just the verdict.
  • Treat CAUTION as a prompt to read the flagged files yourself before installing.

What's inside

  • SKILL.md

Redistributed unmodified from NVIDIA/SkillSpector under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.