Repo: NVIDIA/SkillSpector | Apache-2.0 | 20.3K stars | last push 2026-10-15 | named in a Greg Isenberg video.
What it does
A scanner for AI agent skills, MCP servers and similar add-ons. It looks for prompt-injection text, data-exfiltration patterns, risky install steps and supply-chain red flags before you let a skill run on your machine.
Who it is for
Anyone who installs community skills or MCP servers. Those are instructions plus code that your assistant will follow, so a pre-install scan is cheap insurance.
Our read
Verdict: SAFE, with one thing to switch off or understand. It has an optional model-based pass that sends file contents to a provider; the default provider is NVIDIA’s hosted service, and one provider option bills per token. Another option uses a local CLI. Heavy dependencies too.
We borrowed its detection patterns (credited, Apache-2.0) into our own small pre-install checker rather than adopting the whole tool. A scanner lowers risk; it does not replace reading what you install.
How to try it
Run the static checks only, on a skill you already suspect, and leave the model pass off until you have read where it sends data.
Get the full list of 12 vetted repos
Including the five we marked CAUTION and why.
Sascribe is independent. Figures come from the linked primary pages on the date shown and can change. Nothing here is financial advice or a promise of income.