SkillSpector is a security scanner for AI agent skills, detecting vulnerabilities, malicious patterns, and risks before installation. Research shows that 26.1% of skills contain vulnerabilities and 5.2% show likely malicious intent.
It scans Git repos, URLs, zip files, directories, or single files for 64 vulnerability patterns across 16 categories, including prompt injection, data exfiltration, privilege escalation, supply chain, and more. Two-stage analysis: fast static analysis plus optional LLM evaluation.