NVIDIA/SkillSpector

View on GitHub

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.

Stars: 17.9k
Forks: 1.5k
Open beginner issues: 0
Indexed issues: 53
Avg merge: 5d 10h
Merged PRs (30d): 66

Dominant language: Python
License: Apache-2.0
Last GitHub push: Sep 18, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: No code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

6 beginner-friendly issues open

OSV.dev "MODERATE" severity (GHSA scale) silently downgraded to LOW in SC4 findings Open

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

NVIDIA/SkillSpector#587 · Opened Sep 19, 2026
Quoted version metadata creates a false missing-file reference and changes score 0 from SAFE to CAUTION Open

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

NVIDIA/SkillSpector#524 · 1 comment · Opened Sep 11, 2026
compare_scan_accuracy: editable-dependency file:// URL resolves to "C:\C:\..." on Windows Open

Difficulty 1/5 Under an hour Newbie friendliness 90/100

NVIDIA/SkillSpector#485 · 3 comments · Opened Sep 6, 2026
E2 shell arm matches one `env | grep` spelling: a second grep flag, quotes, or egrep all evade "Env Variable Harvesting" Open

Difficulty 2/5 Half a day Newbie friendliness 78/100

NVIDIA/SkillSpector#482 · 1 comment · Opened Sep 5, 2026
EA1: wildcard pattern still false-positives on footnote-legend '*' and on blank lines before the colon Open

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

NVIDIA/SkillSpector#444 · 1 comment · Opened Aug 27, 2026
P2 "Hidden Instructions" rule produces false positives due to missing word boundary on GET Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

NVIDIA/SkillSpector#297 · 2 comments · Opened Jul 22, 2026

NVIDIA/SkillSpector

Get new issues in your inbox