📺 Watch the full tutorial on YouTube

🛡️ SkillSpector Dashboard — NVIDIA AI Agent Security Scanner

A single-file Streamlit dashboard that wraps the NVIDIA/SkillSpector CLI and gives you a clean visual interface to scan AI agent skills (Claude MCP tools, Cursor extensions, etc.) for security vulnerabilities — powered by NVIDIA's open-source scanner with 64 vulnerability patterns across 16 categories.

---

✨ Features

Feature	Detail
🔍 Scan Modes	Local path or GitHub URL
⚡ Static-only	Fast scan without LLM (no API key required)
📊 Risk Metrics	Score (0-100), severity band, recommendation
📈 Chart	Severity distribution bar chart
📋 Findings	Summary table + per-finding expanders with remediation
🧩 MCP Support	Scans Claude MCP tools, Cursor extensions, AI agent skills
🔐 64 Patterns	Prompt injection, data exfiltration, privilege escalation & more

---

🚀 Quick Start

1 — Install dependencies

# Install SkillSpector (the CLI that powers the scans)
pip install skillspector

# Install the dashboard dependencies
pip install streamlit pandas

2 — Run the dashboard

streamlit run app.py

Open http://localhost:8501 in your browser.

---

🧭 Usage

1. Sidebar → Source — choose Local Path or GitHub URL
2. Paste your target (e.g. ./my-mcp-skill/ or https://github.com/user/repo)
3. Tick Static only to skip LLM analysis (fast, no API key needed)
4. Click Run Scan

---

📁 File Structure

SkillSpector/
├── app.py          ← the dashboard (~97 lines)
├── README.md       ← this file
└── skillspector/   ← cloned NVIDIA/SkillSpector repo + .venv

---

🚦 Risk Score Legend

Score	Band	Verdict
0 – 20	🟢 LOW	SAFE
21 – 50	🟡 MEDIUM	CAUTION
51 – 80	🟠 HIGH	DO NOT INSTALL
81 – 100	🔴 CRITICAL	DO NOT INSTALL

---

🧪 Live Demo Examples

Paste any of these paths into the Local Path field in the Streamlit sidebar and click Run Scan.

Example 1 — 🔴 Malicious Skill (High Risk)

skillspector/tests/fixtures/malicious_skill

What to expect: CRITICAL/HIGH score. Findings include keylogger indicators, C2 framework patterns, data exfiltration, and YARA rule hits for malware. Best example to demo the red-alert dashboard state.

---

Example 2 — 🟠 Overprivileged MCP Tool (Medium–High Risk)

skillspector/tests/fixtures/mcp_overprivileged_skill

What to expect: Medium-to-high score. Findings highlight wildcard permissions (* in SKILL.md), over-declared capabilities that aren't used in code, and MCP Least Privilege violations (LP2, LP4 rules). Great for demoing the policy/permissions analysis.

---

Example 3 — 🟢 Clean Safe Skill (Score 0)

skillspector/tests/fixtures/mcp_clean_skill

What to expect: Score 0/100, verdict SAFE, zero findings. Shows the green "No security issues detected" confirmation — useful for demonstrating a passing baseline.

---

🔒 What SkillSpector Scans For

• Agent-Specific Risks: Prompt injection, excessive agency, tool misuse, rogue-agent behavior, system prompt leakage, memory poisoning, trigger abuse
• General Security Risks: Data exfiltration, privilege escalation, supply-chain issues, dangerous code patterns (AST analysis)
• Framework-Specific Risks: MCP (Model Context Protocol) least privilege violations and tool poisoning
• Dependency Checking: Live vulnerability lookups via OSV.dev for known CVEs

---

🛠️ Tech Stack

• NVIDIA/SkillSpector — Core CLI security scanner
• Streamlit — Web dashboard frontend
• Pandas — Data handling for findings table
• Python 3.12+

---

Built on SkillSpector v2.1.3 by NVIDIA.

---