Pre-install inspection for agent skills
Inspect a skill before it runs on your machine.
Claude Code, Codex and MCP skills checked for prompt injection, data exfiltration and dangerous code. You get an inspection report: every finding, its evidence, and a verdict.
- Skill
- github.com/acme/pdf-tools
- Checks
- 24 run · 0 skipped
- Findings
- 9 · 4 high
- Risk
- 100 / 100
How an inspection works
- 01 · Target
Paste a link
A GitHub, GitLab, Bitbucket or Hugging Face repository or folder, a single SKILL.md, an upload, or an MCP server’s name.
- 02 · Checks
More than 20 analyzers read it
Hidden instructions, exfiltration, dangerous code, tampered artifacts and poisoned MCP tools. AI review reads it as a whole, if you ask.
- 03 · Verdict
Get the report, and its stamp
Passed, review first, or rejected, with every finding located, explained and given a fix.
An actual report
skillspector’s own test fixture of a poisoned MCP tool- 01HIGH“ignore previous instructions”Prompt injection · Tries to override the agent’s instructions or safety rules.SKILL.md:10
- 02HIGHHidden HTML comment in tool metadataMCP tool poisoning · Invisible to people, but read by the agent: a place to hide instructions.SKILL.md:1
- 03HIGHLook-alike letters in a tool nameMCP tool poisoning · Cyrillic or Greek letters that make a malicious tool pass for a trusted one.SKILL.md:1
What an inspection checks
- ☑ 01
Prompt injection
Hidden instructions, anti-refusal tricks, system-prompt leaks and memory poisoning.
- ☑ 02
Data exfiltration
Reading secrets or agent data and sending it elsewhere, including server-side requests.
- ☑ 03
Dangerous code
Privilege escalation, tool misuse, unsafe deserialization, malware signatures and code-flow analysis.
- ☑ 04
Supply chain & MCP
Tampered artifacts, risky dependencies, and MCP tools that are poisoned, over-privileged or change later.
Every inspection runs more than 20 static analyzers from NVIDIA/skillspector. AI review adds a semantic read of what the skill is trying to do.
What you can inspect
Links
A repository, one folder in it, or a single skill file, on GitHub, GitLab, Bitbucket or Hugging Face.
Uploads
Drop a .zip of a skill, or its SKILL.md, to check one you haven’t published. The file is deleted once it’s inspected.
Private GitHub repositories
Connect GitHub, choose the repositories it may read, and inspect them like any link. The report stays yours.
Repositories with several skills
Each skill gets its own verdict and report, under one overall result.
MCP servers
A server’s name from the MCP Registry, to check its posture: pinned packages with valid hashes, a source repository, an active status and HTTPS endpoints.
Optional AI review
A deeper, semantic read of the skill with your own Claude key, saved to your account or pasted once. The skill’s content goes to Anthropic, and only when you ask.
Keep track
Skills change. See what a new version brings, and focus on what’s new.
History
Your inspections in one register you can sort and filter, each target’s lined up as a timeline. Follow an inspection’s checks and log while it runs.
Re-inspect, and see what changed
Inspect a skill again: findings are marked new, fixed or unchanged, with the change in score and verdict.
Baselines
Accept the findings you’ve reviewed, and see only what’s new next time. A skill can ship a baseline of its own, applied only if you ask.
Share and automate
Reports that travel: to a teammate, a README, or a pull request.
Export
Download a report as skillspector’s JSON, or as SARIF for GitHub code scanning and other SARIF tools.
Share links and the inspection tag
A read-only link to a report that works without signing in, until you revoke it, and a README badge that shows its stamp.
GitHub Action and API tokens
Inspect the skills a pull request changes and comment with each verdict; start and read inspections from scripts and CI.
Private by default
- Your inspections and their reports are yours alone, until you share one.
- An uploaded skill is deleted as soon as it’s inspected.
- A Claude key you save is checked, encrypted, and never shown again.
- AI review runs only when you turn it on, and the skill goes only to the provider you chose.
- You can delete your account, and everything of yours goes with it.
Free software
Inskect is free software under the AGPL-3.0, built on NVIDIA’s skillspector, run as a library. Run your own with Docker Compose, with accounts or without.
Questions
Which agents does it work with?
Any that load agent skills, a folder with a SKILL.md: Claude Code, Codex and others. It also checks MCP servers listed in the MCP Registry. An inspection reads the skill’s files, so it doesn’t matter which agent will run them.
How far can I trust a verdict?
It’s a strong first check, not a guarantee. More than 20 analyzers look for known techniques, and the optional AI review reads the skill as a whole; each finding is explained so you can judge it yourself. “Passed” means nothing it knows of was found: read the findings, and the code, before giving a skill access to your machine.
What does it cost, and how much can I inspect?
It’s free to use. AI review runs on your own Claude key, so what it costs is between you and Anthropic. Each account can run 10 inspections a day, and 2 at once.
Can I run it myself?
Yes. Inskect is free and open source software, under the AGPL-3.0 licence. Run it with Docker Compose on your own server, with accounts or without. Admins get a backoffice with users, an activity log, a health panel, rate limits, quotas and a switch that pauses new inspections, and alerts to Slack, Discord, any webhook or email when inspections fail.
Inspect the next skill before you install it.
Create an account in a few seconds: your reports stay private to it.