Tool
SkillSpector
NVIDIA/SkillSpector
What it is
A scanner that checks agent and MCP skills, from a repository, archive, URL or folder, for prompt injection, data leaks and supply-chain risk before installation, with an optional model stage.
Who it might suit
Teams that install third-party agent skills and want a report on each one before it reaches a coding agent.
What to check first
The README says its default model setting targets a DeepSeek model expected to be retired and that local models are untested by the contributor. Installation pulls in further third-party software, and a gateway header variable holding keys counts as a secret.
How it runs
Command-line tool and MCP server
Written