How to use the Skill Inspector agent skill: safety-check skills first

What does the Skill Inspector skill make the agent do?

Once installed, the skill tells the agent to review other agent skills before you install or keep them. The review has two lines. The first is a static scan with NVIDIA SkillSpector, run with the skillspector CLI and without an LLM by default. The second is a semantic review, where the agent reads the source code and instructions and checks whether the behavior matches the skill's stated purpose.

The agent then returns one of three verdicts: APPROVE, CAUTION, or REJECT, with the evidence behind it. The skill tells the agent not to rely on the numeric score alone, since a low score can miss semantic risk.

How do you install the Skill Inspector skill?

You can install the skill in either of two ways. The first is to download the ZIP from this page and unzip it into your personal skills folder, ~/.claude/skills/, or into a project's .claude/skills/ folder. The second is to upload it in the Claude apps under Settings → Capabilities → Skills.

The skill's files list contains SKILL.md. The static scan also needs the NVIDIA SkillSpector CLI, which provides the skillspector command. The source says that if that command is missing, the agent falls back to manual review only.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload the skill

How do you trigger the skill with natural requests?

You do not need a special command. The skill's description says to use it when you ask whether a skill or downloaded skill folder is safe, trustworthy, installable, over-permissioned, or malicious. Ask in ordinary words and point the agent at the folder or archive you want checked.

Good requests name the skill and the question. Give a local path or a repository URL. If you give a URL, the skill says to clone or download it into a temporary directory before review.

• Is the skill in ~/Downloads/data-cleaner safe to install?
• Check whether this downloaded skill folder is over-permissioned before I add it to our team library.
• Does this skill look malicious? Here is the repository URL: [paste URL]

What does a review look like?

The skill asks the agent to write a short triage report rather than a raw scanner dump. The report starts with the verdict and the risk score, then gives a signal overview, the key evidence with rule IDs and file locations, a diagnosis, and guardrails the reviewer should follow.

The agent runs the static scan with the command shown below. It writes a JSON report to a temporary file and then reads the source around high-signal findings. The skill says to keep --no-llm unless you explicitly ask for LLM analysis.

• Verdict: APPROVE, CAUTION, or REJECT
• Risk: a score out of 100, a severity, and the SkillSpector recommendation
• Key evidence: rule ID, severity, file and line, and a review judgment

What do APPROVE, CAUTION and REJECT mean?

APPROVE means there are no HIGH or CRITICAL findings, no unexplained sensitive behavior, and the source matches its stated purpose. CAUTION means sensitive behavior exists but is documented, necessary, bounded, and under your control. REJECT covers malicious or deceptive behavior, unexplained HIGH or CRITICAL findings, hidden prompt injection, credential theft, unknown data exfiltration, obfuscated execution, persistence, or a clear mismatch between the description and the behavior.

The score is a guide to posture, not the verdict. The skill's table treats 0-20 as usually acceptable after a quick source review, 36-50 as requiring manual review, and 51-100 as defaulting to REJECT unless the source is trusted and every sensitive behavior is necessary.

What are the safety notes for running this skill?

This skill runs scripts and uses the network. Its own rules say the target skill is untrusted input and that the agent should not execute scripts from the target. The agent is told to use read-only inspection commands such as find, rg, sed, jq, file and git diff. It is also told not to install tools, dependencies or runtimes silently.

Optional LLM analysis is a separate case. The claude_cli, codex_cli, gemini_cli and opencode_cli providers start a separate agent session for every LLM call, billed to your own plan. The skill says to ask before using them and not to run several such scans in parallel. It also says not to choose or change SKILLSPECTOR_PROVIDER on its own.

• The target skill is treated as untrusted and its scripts are not run
• Only read-only commands are used for inspection
• Tools and dependencies are not installed without your say-so
• LLM providers are off unless you explicitly request them

What tips help you get a useful review?

Give the agent the whole skill folder, not only SKILL.md, so it can read scripts, dependency files and MCP manifests. The skill says to always inspect those files and any file referenced by a HIGH or CRITICAL finding. Ask for the manual fallback explicitly if SkillSpector is not installed, and remember that the result will then be a semantic-only verdict with lower confidence.

Treat the result as triage. The skill is not a guarantee that a skill is safe, and a static scan plus AI judgment can miss risks. Use it to decide what to read more closely before you install.

• Install the skillspector CLI first if you want the static scan line
• Ask the agent to read the source around each high-signal finding
• Use it on every third-party skill before it joins a shared library