SkillSpector

工具介绍

AI代理技能的安全扫描仪. 发现弱点、恶意模式和安全风险.

核心特点

• •Scan agent skills before installation — Hosted guide: when to scan, how to read a report, and how to gate installs.
• •Development guide — Architecture, package layout, and how to extend the analyzer pipeline.
• •Analysis resource bounds — Fail-closed bundle, parser, nested-artifact, ledger, and finding ceilings.
• •Pi extension — Install SkillSpector as a Pi tool for scanning skills from inside agent sessions.
• •Multi-format input: Scan Git repos, URLs, zip files, directories, or single files
• •Two-stage analysis: Fast static analysis + optional LLM semantic evaluation
• •Live vulnerability lookups: SC4 queries OSV.dev for real-time CVE data with automatic offline fallback
• •Multiple output formats: Terminal, JSON, Markdown, and SARIF reports
• •Risk scoring: 0-100 score with severity labels and clear recommendations
• •Baseline / false-positive suppression: Accept known findings via a glob-rule or fingerprint baseline so re-scans surface only *new* issues (docs)