Об этом Skill
Skill Inspector combines NVIDIA SkillSpector’s static findings with an agent’s manual review of source, permissions, network access and user control. It produces an evidence-based APPROVE, CAUTION or REJECT verdict instead of relying on the risk score alone.
Почему мы его выбрали
A focused workflow with its task instructions and supporting files available in the linked GitHub directory.
Для каких задач подходит
- Review a downloaded Skill, archive or repository before installation.
- Investigate a finding involving credentials, shell execution, external requests or MCP permissions.
What you receive
A concise triage report with a verdict, scanner findings and source locations, semantic analysis, and conditions for use. The target Skill is inspected without executing its scripts. Scanning is defense in depth and cannot guarantee safety.
| Команда | Для чего полезна |
|---|---|
uv tool install git+https://github.com/NVIDIA/skillspector.git | Install the optional SkillSpector CLI for the static scan. |
Перед использованием
- A compatible Agent and access to the Skill source. Install the SkillSpector CLI for static scanning; if unavailable, the workflow explicitly falls back to manual review. Python 3.12+ and uv are needed for the CLI installation below.
- The workflow defaults to --no-llm; optional model analysis requires user consent and provider configuration. Dependency names and versions may be sent to OSV.dev even with --no-llm.
Источники и материалы
Ссылки на оригинальные материалы приведены ниже. Практические идеи предложены редакцией SkillHey.
