Open sourcePython · ≈23k stars · Apache-2.0
SkillSpector
Security scanner that checks agent skills for injection, exfiltration and supply-chain risks before install.
SkillSpector scans AI agent skills (for Claude Code, Codex CLI, Gemini CLI and MCP) before installation. It accepts Git repos, URLs, zips, directories or single files and checks 71 vulnerability patterns across 17 categories, including prompt injection, data exfiltration, privilege escalation, supply chain, memory poisoning and tool misuse. Analysis combines fast static checks with optional LLM semantic evaluation, live OSV.dev CVE lookups, a 0-100 risk score and terminal, JSON, Markdown or SARIF output. It is part of NVIDIA's Verified Skills pipeline that scans and signs skills before publication.
Neighbours on the workbench
TypeScript · ≈393k stars · MIT
openclaw/openclaw
The viral open-source personal AI assistant that really does things.
Maintained by OpenClaw Foundation
MDX · ≈307k stars · MIT
obra/superpowers
An agentic skills framework and software methodology that works.
Maintained by Jesse Vincent (obra)
Shell · ≈306k stars · MIT
mattpocock/skills
Small, composable agent skills for real engineering work.
Maintained by Matt Pocock (AI Hero)
Connections
Relations from the Harness Hub knowledge graph, as charted in the State of Harness reports.
Maintained by · 1
- NVIDIAOrganisation
Built on · 4
- Claude CodeProject
- CodexProject
- Gemini CLIProject
- Model Context ProtocolProject
Sources
Verified Oct 29, 2026