このスキルについて
Skill Inspector combines NVIDIA SkillSpector’s static findings with an agent’s manual review of source, permissions, network access and user control. It produces an evidence-based APPROVE, CAUTION or REJECT verdict instead of relying on the risk score alone.
おすすめする理由
A focused workflow with its task instructions and supporting files available in the linked GitHub directory.
役立つこと
- Review a downloaded Skill, archive or repository before installation.
- Investigate a finding involving credentials, shell execution, external requests or MCP permissions.
What you receive
A concise triage report with a verdict, scanner findings and source locations, semantic analysis, and conditions for use. The target Skill is inspected without executing its scripts. Scanning is defense in depth and cannot guarantee safety.
| コマンド | 用途と使いどころ |
|---|---|
uv tool install git+https://github.com/NVIDIA/skillspector.git | Install the optional SkillSpector CLI for the static scan. |
使う前に
- A compatible Agent and access to the Skill source. Install the SkillSpector CLI for static scanning; if unavailable, the workflow explicitly falls back to manual review. Python 3.12+ and uv are needed for the CLI installation below.
- The workflow defaults to --no-llm; optional model analysis requires user consent and provider configuration. Dependency names and versions may be sent to OSV.dev even with --no-llm.
資料・参照元
元の資料は以下のリンクから確認できます。実践のヒントは SkillHey による編集上の提案です。
