SkillSpector
Scans an agent skill or MCP server for prompt injection, data exfiltration, and supply-chain risk before you install it, returning a risk score, findings, and an install verdict. Over HTTP it accepts remote Git and .zip URLs only.
What it provides
Connect an existing HTTPS deployment, with a scoped token where the service requires one. Heavy jobs stay on that service instead of using bot memory.
Connection requirements
Install the MCP extra (`uv tool install 'skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git'`) on a host outside the bot and run `skillspector mcp --transport http --host 127.0.0.1 --port 8000`; FastMCP mounts the streamable HTTP server at /mcp. Upstream states plainly that the HTTP transport ships WITHOUT authentication and any caller that reaches the port can invoke scan_skill, so keep the port on loopback and publish /mcp through a TLS reverse proxy that enforces the bearer token below. Over HTTP the server deliberately rejects local paths and file:// URLs, so a scan target must be a remote Git or .zip URL — the local-directory examples in the README apply to the stdio transport only. The LLM stage is optional and bring-your-own-key: set SKILLSPECTOR_PROVIDER plus that provider’s credential on the scanner host, or pass use_llm false for a static-only scan that needs no credentials at all. Those keys stay on the scanner host and the bot never holds them. Always read llm_used and scan_mode in the verdict, because a low risk_score from a static-only pass is not the same as a clean full scan. Treat safe_to_install as advice, not a guarantee.
- Protocol
- Streamable HTTP MCP
- Endpoint
https://skillspector.example.com/mcp- Authentication
- bearer
mcp toolsmcp call scan_skill '{"target":"https://github.com/OWNER/REPO"}'Where to add it
Open Dashboard Tools, select a running OpenClaw or Hermes instance, then use the card’s Install or Connect action. External services may require an HTTPS endpoint and credentials; the dashboard shows those fields before anything is saved.