DSH Plugins技能

SkillSpector

NVIDIA/SkillSpector

SkillSpector is a tool for DeepSeek Harness. Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.

查看仓库项目主页

Stars: 17k
Forks: 1.4k
Issues: 131
Update: 4 days

REVIEW SCORECARD

评测成绩单

8.7/10Excellent

detail.dimSecurity9.0

detail.dimQuality9.0

detail.dimContent8.0

detail.dimDeps7.0

detail.dimMaintenance9.0

✓ 无Risky检出 · 自动化扫描结果仅供参考，非官方背书

AI DEEP REVIEW

AI 深度评测

8.0/10Recommended

NVIDIA's actively maintained security scanner fills a real gap by vetting AI agent skills before installation.

Code quality8

README documents a Makefile-based build with uv/pip, dev dependencies, Docker support, and a DEVELOPMENT.md covering architecture and analyzer pipeline extension.

Security7

The tool itself is a security scanner with fail-closed resource bounds, ingest caps against zip bombs, and OpenSSF Scorecard badge, though it downloads third-party OSS and optionally sends code to LLM providers.

Utility9

Addresses a concrete, common pain point by scanning skills for 71 vulnerability patterns across 17 categories before install, with cited research that 26.1% of skills contain vulnerabilities.

Maintenance8

Last updated 2026-09-12, not archived, 16,992 stars, and part of NVIDIA's Verified Skills pipeline with an active skills catalog.

Docs8

README provides install commands for uv, source, and Docker, plus usage examples, size limits, and links to hosted scanning guides, DEVELOPMENT.md, and suppression docs.

Generated by AI after reading the project README, as a decision aid; neutral scores are given when information is thin. Not an official endorsement.

PROJECT README项目说明展开Collapse

正在读取 GitHub README...

INSTALL REFERENCE

安装参考

待结构检查

uv tool install git+https://github.com/NVIDIA/skillspector.git

This command comes from an explicit install reference in the README and is provided for reference only — it is never auto-executed by a DSH host.

PROJECT TOPICS

项目标签

agent-security agent-skills agentic-ai ai-security claude-code mcp prompt-injection security-scanner security-tools security-workflow supply-chain-security

VALIDATION LADDER

验证进度

待结构检查

01市场发现Passed

02归类识别Passed

03结构检查Pending

04实机验证Pending

FAQ

Frequently Asked Questions

What is SkillSpector used for?

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.

How popular is SkillSpector?

SkillSpector has 16,992 stars and 1,446 forks on GitHub, last updated 2026-09-12.

What license does SkillSpector use?

SkillSpector is distributed under the Apache-2.0 license.

Is SkillSpector compatible with DeepSeek Harness?

SkillSpector is listed in the DSH Universe directory as a tool for DeepSeek Harness. This plugin is listed in the DSH Universe directory and covered by its validation pipeline.

CLASSIFICATION EVIDENCE