À propos de ce Skill
Skill Inspector combines NVIDIA SkillSpector’s static findings with an agent’s manual review of source, permissions, network access and user control. It produces an evidence-based APPROVE, CAUTION or REJECT verdict instead of relying on the risk score alone.
Pourquoi ce choix
A focused workflow with its task instructions and supporting files available in the linked GitHub directory.
À quoi il sert
- Review a downloaded Skill, archive or repository before installation.
- Investigate a finding involving credentials, shell execution, external requests or MCP permissions.
What you receive
A concise triage report with a verdict, scanner findings and source locations, semantic analysis, and conditions for use. The target Skill is inspected without executing its scripts. Scanning is defense in depth and cannot guarantee safety.
| Commande | À quoi elle sert |
|---|---|
uv tool install git+https://github.com/NVIDIA/skillspector.git | Install the optional SkillSpector CLI for the static scan. |
Avant de l’utiliser
- A compatible Agent and access to the Skill source. Install the SkillSpector CLI for static scanning; if unavailable, the workflow explicitly falls back to manual review. Python 3.12+ and uv are needed for the CLI installation below.
- The workflow defaults to --no-llm; optional model analysis requires user consent and provider configuration. Dependency names and versions may be sent to OSV.dev even with --no-llm.
Sources et références
Les sources originales sont liées ci-dessous. Les pistes pratiques sont des suggestions de la rédaction de SkillHey.
