Acerca de este Skill
Skill Inspector combines NVIDIA SkillSpector’s static findings with an agent’s manual review of source, permissions, network access and user control. It produces an evidence-based APPROVE, CAUTION or REJECT verdict instead of relying on the risk score alone.
Por qué lo elegimos
A focused workflow with its task instructions and supporting files available in the linked GitHub directory.
Para qué sirve
- Review a downloaded Skill, archive or repository before installation.
- Investigate a finding involving credentials, shell execution, external requests or MCP permissions.
What you receive
A concise triage report with a verdict, scanner findings and source locations, semantic analysis, and conditions for use. The target Skill is inspected without executing its scripts. Scanning is defense in depth and cannot guarantee safety.
| Comando | Para qué sirve |
|---|---|
uv tool install git+https://github.com/NVIDIA/skillspector.git | Install the optional SkillSpector CLI for the static scan. |
Antes de usarlo
- A compatible Agent and access to the Skill source. Install the SkillSpector CLI for static scanning; if unavailable, the workflow explicitly falls back to manual review. Python 3.12+ and uv are needed for the CLI installation below.
- The workflow defaults to --no-llm; optional model analysis requires user consent and provider configuration. Dependency names and versions may be sent to OSV.dev even with --no-llm.
Fuentes y referencias
Las fuentes originales se enlazan a continuación. Los puntos de partida prácticos son sugerencias editoriales de SkillHey.
