AI agent skills get implicit trust; this scanner doesn't

What it does SkillSpector is a static—and optionally LLM-assisted—security scanner for AI agent skills, the plugins and tools used by systems like Claude Code, Codex CLI, and Gemini CLI. It ingests code from directories, Git repos, zip files, or single files and hunts for 64 vulnerability patterns across 16 categories, including prompt injection, data exfiltration, supply chain risks, and rogue agent behavior. It returns a 0–100 risk score with severity labels and recommendations, outputting results to the terminal, JSON, Markdown, or SARIF.

The interesting bit The scanner treats AI skills as a distinct attack surface with their own taxonomy: it looks for MCP-specific issues like tool poisoning and least-privilege violations alongside traditional AST taint tracking and YARA malware signatures. The optional LLM semantic layer can run against local models via Ollama or vLLM, but the tool works offline with static analysis alone if you prefer not to send code to a remote endpoint.

Key highlights

• Detects 64 patterns across 16 categories, from exec() calls and credential exfiltration chains to memory poisoning and trigger abuse
• Queries OSV.dev in real time for known CVEs in dependencies, with automatic offline fallback
• Supports multiple LLM providers (OpenAI, Anthropic, NVIDIA, and local OpenAI-compatible servers) for semantic analysis, or skips them entirely with --no-llm
• Outputs risk reports in Terminal, JSON, Markdown, and SARIF formats for CI/CD integration
• Assigns a 0–100 risk score with clear severity labels and recommendations

Caveats

• The README cites specific vulnerability and malicious-intent percentages without linking to or naming the underlying research

Verdict Worth a look if you install third-party AI agent skills and want to catch supply-chain risks, prompt leaks, and backdoors before they run. Probably overkill if you only ever execute skills you wrote yourself.