# NVIDIA/SkillSpector

> Security scanner for AI agent skills: detects vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before installation.

- Magnitude: 3.2 out of 10 — Steady
- Stars: 24,009 total · +146 stars measured 2026-11-02, 00:09–23:49 UTC
- Star trust: star growth looks organic
- Category: Security · Language: Python · License: Apache-2.0 · Created: 2026-03-21 · Last push: 2026-11-02
- GitHub: https://github.com/NVIDIA/SkillSpector · Homepage: https://docs.nvidia.com/skills/scanning-agent-skills · Page: https://gitnova.dev/en/r/NVIDIA/SkillSpector

## Useful for

- Scan a downloaded Claude Code skill for prompt injection and data exfiltration before installing it
- Run the scanner over an MCP skills repository and produce a SARIF report for CI
- Set up a baseline so re-scans surface only new findings

## Why it’s here

- Star-counter measurements on 2026-11-02 (UTC), 00:09–23:49: 23863 → 24009 stars (+146). This is the change over that interval.
- Interest is fading: the two-day pace is 59% of the previous week and a half.
- About 15 forks a day — people are taking the code.

## Star trust

Star growth looks organic.

Star-trust labels are heuristics based on the repository’s behavior, not a check of every stargazer.

## Numbers

- Forks: 2,071
- Issues and pull requests: 971
- Watchers: 81
- Average over the last week: 230 per day
- Usual pace: 133 per day
- Stars in the last hour (measured): 5
- Latest release: v2.13.3 (2026-11-02)

## Stars per day, last 30 days (oldest → newest, today is partial)

2026-10-05 … 2026-11-03: 99, 96, 76, 75, 79, 90, 95, 94, 72, 79, 93, 73, 60, 72, 126, 117, 109, 174, 103, 275, 244, 821, 361, 366, 244, 154, 167, 170, 115, None

## Magnitude by day, last 14 days

10-09 2.7, 10-10 2.8, 10-11 2.8, 10-12 3.0, 10-13 3.0, 10-14 2.7, 10-26 6.0, 10-27 7.8, 10-28 6.3, 10-29 5.2, 10-30 4.1, 10-31 3.5, 11-01 3.3, 11-02 3.3

## Similar by description

1. **Spectrmachina/Ztrust** — 0.0 · Steady · Security · Python · +0 stars measured 2026-11-02, 04:19–23:46 UTC
   Zero-trust supply-chain scanner that detects malicious and vulnerable dependencies, typosquats, leaked secrets and unsafe GitHub Actions, and pays independent researchers in shielded Zcash via a commit-reveal bounty protocol.
   Full card: https://gitnova.dev/en/r/Spectrmachina/Ztrust.md
2. **BastionPHP/Bastion** — 0.0 · Steady · Go · Not enough measurements today
   Evidence-based PHP security assessment: patch verification, intrusion tracing, and offline reports.
   Full card: https://gitnova.dev/en/r/BastionPHP/Bastion.md
3. **aquasecurity/trivy** — 1.8 · Steady · Security · Go · +19 stars measured 2026-11-02, 00:13–23:53 UTC
   Security scanner that finds vulnerabilities, misconfigurations, secrets and SBOM in containers, Kubernetes, code repositories, clouds and filesystems. Aimed at developers and DevOps for checking artifact security.
   Full card: https://gitnova.dev/en/r/aquasecurity/trivy.md
4. **hevnsnt/CVEngine** — 1.4 · Cooling · Security · Python · +7 stars measured 2026-11-02, 00:12–23:55 UTC
   Self-hosted external attack surface assessment platform: discovers internet-facing assets, fingerprints services and versions, matches live CVEs, and validates findings with safe read-only checks.
   Full card: https://gitnova.dev/en/r/hevnsnt/CVEngine.md

---

Magnitude (0–10) measures how fast and how unusually interest in a repository is growing right now. It is not a quality score.
Days are UTC. “So far today” is a fact; “expected by the end of the day” is a forecast.
Summaries and use cases are written by an LLM (DeepSeek V4.1 Flash) from the README and may be inaccurate: verify specific claims (benchmarks, speed, hardware) in the repository itself.
Data as of 2026-11-02 23:59 UTC, updated every 30 minutes.