Skip to content
Agent Radar
Agent infra

What is SkillSpector?

Latest launch Apache-2.0

Summary

Apache-2.0 scanner from NVIDIA for agent skills and MCP installs, with a local MCP server that exposes scan_skill.

Category
Agent infra
Open source
Yes
License
Apache-2.0
MCP
Yes
Pricing
Apache-2.0. No paid tier is described on the repository page we used.
Links
WebsiteGitHub

SkillSpector is NVIDIA's scanner for the skills agents install. The repository was created March 21, 2026. The filing, including the dataset percentages NVIDIA publishes, is NVIDIA SkillSpector.

HTTP mode has no authentication of its own. If you expose it beyond localhost, follow the README and put a proxy in front.

SkillSpector alternatives

SkillSpector compared with its alternatives
ToolLicensePricing note
SkillSpectorThis pageApache-2.0 scanner from NVIDIA for agent skills and MCP installs, with a local MCP server that exposes scan_skill.
Apache-2.0Apache-2.0. No paid tier is described on the repository page we used.
WinDbgMicrosoft's Windows debugger. WinDbg MCP, from version 1.2610.1001.0, lets Copilot query an active session.
—WinDbg MCP is included with WinDbg starting at version 1.2610.1001.0.
GitHub MCP serverGitHub's official MCP server. Version 1.0.0 shipped April 16, 2026 with organization issue fields and an MCP Apps flag.
Open sourceThe server repository is public. GitHub product charges, if any, are your existing GitHub plan.

Launches and updates

  • NVIDIA SkillSpector

    SkillSpectorSkillSpector scans agent skills for vulnerabilities and malicious patterns before install. The repository was created March 21, 2026, and includes an MCP server.

Questions

What is SkillSpector?

SkillSpector scans AI agent skills for vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risk before you install them. The NVIDIA/SkillSpector repository is Apache-2.0.

Does SkillSpector have an MCP server?

Yes. The README documents skillspector mcp and a single tool, scan_skill, for Claude Code, Codex CLI, Gemini CLI, or a remote HTTP caller.