jaykatta23/skillspector repository overview

⁠NVIDIA SkillSpector (Docker)

Run the official NVIDIA SkillSpector CLI without installing Python or project dependencies.

SkillSpector is a security scanner for AI agent skills (Claude Code, Codex CLI, Gemini CLI, MCP tools, etc.) that detects vulnerabilities, malicious patterns, prompt injection, supply-chain risks, privilege escalation, and other security issues before installation.

⁠Features

• 🔍 Scan local skill directories, repositories, ZIP archives, or individual SKILL.md files
• 🛡️ Detect 68 security patterns across 17 vulnerability categories
• 🤖 Optional AI-powered semantic analysis using OpenAI-compatible models
• 📄 Generate Terminal, JSON, Markdown, or SARIF reports
• 🔒 Suitable for enterprise and air-gapped deployments
• 🐳 No local Python installation required

⁠Pull the Image

docker pull jaykatta23/skillspector:latest

⁠Scan a Local Directory

Mount your working directory into the container and scan it.

docker run --rm \
  -v "$PWD:/scan" \
  jaykatta23/skillspector:latest \
  scan ./my-skill/

⁠Static Analysis Only

Disable LLM analysis for completely offline scanning.

docker run --rm \
  -v "$PWD:/scan" \
  jaykatta23/skillspector:latest \
  scan ./my-skill/ --no-llm

⁠Scan a Git Repository

docker run --rm \
  jaykatta23/skillspector:latest \
  scan https://github.com/user/my-skill

⁠Scan a ZIP Archive

docker run --rm \
  -v "$PWD:/scan" \
  jaykatta23/skillspector:latest \
  scan ./my-skill.zip

⁠Generate a JSON Report

docker run --rm \
  -v "$PWD:/scan" \
  jaykatta23/skillspector:latest \
  scan ./my-skill \
  --format json \
  --output report.json

The generated report will be written to your mounted host directory.

⁠Using an Internal LiteLLM Gateway

SkillSpector supports any OpenAI-compatible endpoint.

docker run --rm \
  -v "$PWD:/scan" \
  -e SKILLSPECTOR_PROVIDER=openai \
  -e OPENAI_BASE_URL=https://<litellm-endpoint>/v1 \
  -e OPENAI_API_KEY=<api-key> \
  -e SKILLSPECTOR_MODEL=<model-name> \
  jaykatta23/skillspector:latest \
  scan ./my-skill

Examples of supported backends include:

• LiteLLM
• NVIDIA NIM
• Ollama
• vLLM
• llama.cpp
• OpenAI
• Azure OpenAI

⁠Air-Gapped Deployment

SkillSpector supports fully isolated deployments when:

• Source code is available locally.
• LLM inference is provided through an internal OpenAI-compatible endpoint (LiteLLM, NVIDIA NIM, Ollama, etc.).
• External vulnerability feeds are mirrored internally if live CVE lookups are required.

Static analysis operates completely offline.

⁠Upstream Project

NVIDIA SkillSpector

https://github.com/NVIDIA/SkillSpector⁠

⁠Disclaimer

This Docker image is an independently packaged build of the open-source NVIDIA SkillSpector project and is not an official NVIDIA container image.