AgentToolDrop

10 of 43

SkillSpector

Scans agent skills for prompt injection, data exfiltration and supply-chain risks before you install them

Install with uv

uv tool install git+https://github.com/NVIDIA/skillspector.git

Copied from the project's docs at github.com/NVIDIA/SkillSpector

Why you'd want it

SkillSpector scans a skill from a Git repo, URL, zip file, directory or single SKILL.md against 71 patterns in 17 categories, including prompt injection, data exfiltration, privilege escalation, MCP tool poisoning and MCP least privilege. It runs static analysis first and an optional LLM evaluation second, gives a 0 to 100 risk score, and writes terminal, JSON, Markdown or SARIF reports. It can also run as an MCP server with a scan_skill tool, so Claude Code, Codex CLI or Gemini CLI can gate skill and MCP installs on the result. It is part of NVIDIA's Verified Skills pipeline.

Best for

  • Vetting third-party skills before install
  • CI checks with SARIF output
  • Gating installs from inside an agent

Use it when

You install skills or MCP servers from public repositories and want a report on risky patterns before they reach your agent.

Skip it if

You only use skills you wrote yourself. The optional LLM analysis sends skill content to the configured provider with your API key; --no-llm runs static checks only. The README notes the stdio MCP transport still has an initialize hang reported in issue #199.

Editor's note

The MCP server needs the mcp extra: uv tool install 'skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git', then skillspector mcp.

Related tools

Same category or shared tags.

  1. Rank 34

    Repomix

    Devtool

    Packs a repository into one AI-friendly file in XML, Markdown, JSON or plain text

    • score 28
    • 28.8k stars
    • 35 stars/day since creation
    • pushed
    • v1.18.1 on
    • MIT

    Run with npx

    npx repomix@latest
    Use it when, skip it if, stats for Repomix

    Why you'd want it

    Repomix reads a local or remote repository, respects .gitignore and .repomixignore, uses Secretlint to leave out files that match known credential formats, and writes one file with a summary, directory structure and file contents, plus token counts per file. The --compress option uses Tree-sitter to keep key code elements with fewer tokens, and large outputs can be split into parts. It also runs as an MCP server (repomix --mcp) and can generate Claude Agent Skills from a codebase.

    Best for

    • Feeding a whole codebase to a chat model
    • Checking token counts before sending context
    • Packing a remote GitHub repo for reference

    Use it when

    You want to hand an LLM a full or filtered snapshot of a repository in one file, or let an agent pack repos through MCP.

    Skip it if

    Your coding agent already reads files in your workspace and you have no need for a single packed file. By default the MCP server can read any path the host user can, so use --sandbox with untrusted clients.

    Stats

    Stars
    28,841
    Last push
    Release
    v1.18.1,
    License
    MIT
    Pricing
    Open source
    Works with
    Any MCP client, Claude Code, Cursor, VS Code, Claude Desktop, Docker, Web
    Stars per day, since repo creation
    35
    New and rising score
    28 of 100

    Full stat block for Repomix

  2. Rank 1

    universal-modder

    Devtool

    Gives a coding agent skills, a CLI and a shared knowledge base for modding PC games you own

    • score 83
    • 7.7k stars
    • 513 stars/day since creation
    • pushed
    • MIT

    Install as a Claude Code plugin

    /plugin marketplace add rehan-remade/universal-modder
/plugin install universal-modder@universal-modder
    Use it when, skip it if, stats for universal-modder

    Why you'd want it

    universal-modder packages Agent Skills, three subagents and a Python CLI called um that a coding agent uses to mod a game: um scan finds Steam, Epic and Xbox installs and fingerprints the engine, loaders, anti-cheat and save folders, um backup snapshots saves, and um fal, um sprite and um render3d make and fit art, 3D and audio for the engine. The mod-any-game skill runs a fixed loop of recon, a backed-up lab, reading the real code, building one slice, testing it in the running game and writing a field note. Those field notes live in a knowledge base in the repo that agents search with um kb before starting and add to by pull request.

    Best for

    • Modding single-player PC games with an agent
    • Generating sprites and 3D assets for mods
    • Reusing other agents' modding notes

    Use it when

    You want Claude Code, Codex, Gemini CLI or another agent to work out how a game you own is built and ship a mod for it, with assets and an in-game test.

    Skip it if

    You play online games with anti-cheat: its own safety notes say injecting into an online client breaks the game's terms and gets accounts banned, and it refuses to do so. It touches game folders, saves, processes and your mouse and keyboard (asking first), asset generation needs a fal API key or a local ComfyUI server, and the repo is about two weeks old with no tagged release.

    Stats

    Stars
    7,697
    Last push
    Release
    none tagged
    License
    MIT
    Pricing
    Open source
    Works with
    Claude Code, Codex, Gemini CLI, VS Code, Cursor, Windows
    Stars per day, since repo creation
    513
    New and rising score
    83 of 100

    Full stat block for universal-modder

  3. Rank 5

    Agent Skills (Addy Osmani)

    Devtool

    Adds engineering workflow skills for specs, tests, review and shipping to your coding agent

    • score 64
    • 107k stars
    • 442 stars/day since creation
    • pushed
    • 0.6.13 on
    • MIT

    Install all skills with the skills CLI

    npx skills add addyosmani/agent-skills
    Use it when, skip it if, stats for Agent Skills (Addy Osmani)

    Why you'd want it

    Agent Skills is a pack of SKILL.md workflows covering the path from idea to launch, such as spec-driven development, test-driven development, code review, security hardening and shipping, each ending with evidence requirements like passing tests or build output. It also ships reviewer personas, reference checklists and, in Claude Code, slash commands such as /spec, /plan, /build, /test, /review and /ship. It installs with the skills CLI or as a Claude Code, Codex or Gemini CLI plugin, with setup guides for Cursor, Windsurf, OpenCode and GitHub Copilot.

    Best for

    • Making agents write specs and tests first
    • Shared engineering standards across several agents
    • Structured code review before merge

    Use it when

    Your coding agent skips specs, tests or review and you want step-by-step workflows it follows across a project.

    Skip it if

    Your changes are small one-off edits where a spec, plan and test cycle adds overhead. Installing a single skill with npx leaves out the shared reference checklists.

    Stats

    Stars
    106,751
    Last push
    Release
    0.6.13,
    License
    MIT
    Pricing
    Open source
    Works with
    Claude Code, Cursor, Codex, Gemini CLI, Windsurf
    Stars per day, since repo creation
    442
    New and rising score
    64 of 100

    Full stat block for Agent Skills (Addy Osmani)

For agents

The same entry, as files an agent can read without scraping this page. 

# read one entry
curl -s https://agenttooldrop.com/tools/skillspector.md

# list the MCP servers in the catalog
curl -s https://agenttooldrop.com/tools.json \
  | jq -r '.tools[] | select(.category=="mcp-server") | .slug'