Open Source Alternatives
  • Alternatives
  • Categories
    Categories by size882 projects
    • Developer Tools461
    • AI & Machine Learning404
    • Web Development196
    • Business & Productivity191
    • Communication & Collaboration126
    • Security & Monitoring126
    • IT Management123
    • Product & Project Management106
    • Cloud & Hosting105
    • Data & Analytics104
    Browse all 21 categoriesLLMOps & AI Tooling, Design & Creative and 9 more
  • Blog
  • Advertise
SearchNotion, Slack, password manager.../
Submit
Open Source Alternatives
  • Alternatives
    • Developer Tools461
    • AI & Machine Learning404
    • Web Development196
    • Business & Productivity191
    • Communication & Collaboration126
    • Security & Monitoring126
    • Browse all 21 categories
  • Blog
  • Advertise
Submit your project

New open source projects by email

The projects we add and every new guide. Free, unsubscribe any time.

Open Source Alternatives LogoOpen Source Alternatives

Handpicked Open Source Alternatives to Paid Softwares

Product

  • Categories
  • Tag
  • Advertise

Resources

  • Blog
  • Collection
  • Submit

Company

  • Privacy Policy
  • Terms of Service
  • Refund Policy
  • Sitemap

Alternatives

  • Claude Code
  • Jira
  • Notion
  • Slack
  • Linear
  • Wispr Flow
  • All alternatives
© 2026 Open Source Alternatives. All rights reserved.
Open SourceAlternatives
Home/Categories/Security & Monitoring/SkillSpector
icon of SkillSpector

SkillSpector

Open source alternative to Lasso Security

  • 20.7K stars
  • Apache-2.0
  • Active this week
  • Last commit 1 day ago

Last verified Oct 21, 2026

Secure AI agent skills before installation with static and optional LLM analysis for prompt injection, exfiltration, and supply-chain risks.

Visit websiteGitHub20.7K stars
image of SkillSpector
TL;DR

SkillSpector is a security scanner for AI agent skills that detects vulnerabilities and malicious patterns. It provides a two-stage analysis with live vulnerability lookups and multiple output formats. This tool helps ensure that AI skills are safe to install and use.

Read the full breakdownHide the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ
who it's for

Who SkillSpector is for#

Developers

Ensure the safety of third-party AI skills before integration.

Skip if:

Skip if only using trusted internal skills.

Security Analysts

Assess and report on the security posture of AI agent skills.

Skip if:

Skip if no AI skills are being evaluated.

the problem

The problem it solves#

The project helps solve the problem of identifying vulnerabilities and malicious patterns in AI agent skills before they are installed, ensuring user safety and security.

how SkillSpector solves it

How it solves it#

Multi-format Input

Scan Git repos, URLs, zip files, directories, or single files.

64 Vulnerability Patterns

Detect vulnerabilities across 16 categories including prompt injection and data exfiltration.

Two-stage Analysis

Combine fast static analysis with optional LLM semantic evaluation.

Live Vulnerability Lookups

Query OSV.dev for real-time CVE data with automatic offline fallback.

Multiple Output Formats

Generate reports in Terminal, JSON, Markdown, and SARIF formats.

Risk Scoring

Provides a score from 0-100 with severity labels and recommendations.

strengths · trade-offs

Strengths and trade-offs#

Strengths

  • Comprehensive DetectionIdentifies a wide range of vulnerabilities across various categories.
  • Real-time DataUtilizes live vulnerability lookups for up-to-date security information.
  • Flexible UsageSupports multiple input formats and output report types.
  • User-friendlyProvides clear recommendations based on risk scoring.

Trade-offs

  • -Static Analysis LimitationsStatic analysis may miss vulnerabilities that only manifest during runtime.
  • -Language SupportMay not effectively analyze non-English content.
  • -Image-based AttacksCannot analyze text in images or encrypted/binary code.
versus alternatives

SkillSpector vs alternatives#

SkillSpector vs Snyk Code

SkillSpector and Snyk Code both scan for security risk, but they target different surfaces. SkillSpector focuses on AI agent skills before installation; Snyk Code focuses on application source code security across developer workflows.

FeatureSkillSpectorSnyk Code
LicenseApache-2.0Proprietary service with free and paid plans
Primary targetAI agent skills, skill repositories, zip files, directories, and individual skill filesApplication source code in IDEs, repositories, and CI/CD workflows
Analysis styleStatic checks plus optional LLM semantic analysisSAST scanning with prioritization and automated fix guidance
Vulnerability dataUses OSV lookups for live CVE data with offline fallbackUses Snyk's managed code security engine and workflow integrations

Choose SkillSpector when the risk is installing an agent skill that may contain prompt injection, data exfiltration, excessive agency, MCP tool abuse, or other agent-specific behavior. Its scanner understands the skill format and reports risk in terminal, JSON, Markdown, and SARIF formats.

Choose Snyk Code when the goal is broader application security scanning across a development team. It fits IDE, repository, and pull request workflows better than a skill-specific scanner. SkillSpector is the focused pre-installation check for agent skills; Snyk Code is the managed SAST workflow for application code.

install · quick start

Quick start#

bash
# Local Python install
git clone https://github.com/NVIDIA/skillspector.git
cd skillspector
uv venv .venv && source .venv/bin/activate
make install

# Docker self-hosted scan
make docker-build
docker run --rm -v "$PWD:/scan" skillspector scan ./my-skill/ --no-llm
tech stack · detected from GitHub

What it's built on#

Languages
PythonTypeScript
Infrastructure
AWS
frequently asked

FAQ#

What types of files can SkillSpector scan?

SkillSpector can scan Git repositories, URLs, zip files, directories, and single files.

How does SkillSpector determine risk scores?

Risk scores are calculated based on the severity of detected vulnerabilities, with higher scores indicating greater risk.

Can I use SkillSpector without Python?

Yes, SkillSpector can be run using Docker without needing to install Python.

also worth a look

Similar open-source tools#

REA (Reverse Engineer Anything)

Featured

Alternative toRevEng.AI

AI-powered reverse engineering for binaries, apps, and assemblies.

  • 345,900 GitHub stars
  • MITLicence MIT

iFixAi

Alternative toZenity

Self-hosted AI agent auditing across 60 trust and safety inspections.

  • 30,695 GitHub stars
  • Apache-2.0Licence Apache-2.0

Bifrost

Alternative toPortkey

Open-source AI gateway with 23+ providers, failover, and MCP support.

  • 8,975 GitHub stars
  • Apache-2.0Licence Apache-2.0

Pulse

InSecurity & Monitoring

Read-only Windows diagnostics with a local AI assistant.

  • 368 GitHub stars
  • MITLicence MIT

Vela

Alternative toGoogle Maps

OpenStreetMap and Google data, no account, no Play Services

  • 2,060 GitHub stars
  • GPL-3.0Licence GPL-3.0

OpenShell

Alternative toE2B

Sandboxed runtime for autonomous AI agents, open source by NVIDIA

  • 16,848 GitHub stars
  • Apache-2.0Licence Apache-2.0
by category

Open source tools in these categories#

126

Security & Monitoring

REA (Reverse Engineer Anything), RustDesk, Uptime Kuma404

AI & Machine Learning

freeCodeCamp, OpenClaw, REA (Reverse Engineer Anything)

Featured

Omnara

Alternative toCClaude Managed Agents

Open-source agent deployment API. Self-host or use Omnara Cloud.

  • 2,957 GitHub stars
  • Apache-2.0Licence Apache-2.0
  • #AI Agents

rakazo

Alternative toGrok Bot

AI teammates you own: your keys, your model, your machine.

  • 4,904 GitHub stars
  • Apache-2.0Licence Apache-2.0
  • #AI Agents

Inbox Zero

Alternative toSuperhuman

AI email assistant that drafts replies and clears your inbox

  • 12,712 GitHub stars
  • AGPL-3.0Licence AGPL-3.0
  • #Email
Feature your project

New open source projects by email

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

/
  • Claude Code to OpenCode
  • Jira to Windshift
  • Notion to AppFlowy
  • Slack to Mattermost
  • Linear to GitLab
  • Wispr Flow to Handy
  • CapCut to Concat
  • Grok Bot to rakazo
  • Superhuman to Inbox Zero
  • Airtable to AITable
  • Muse to OpenClaw
  • GitHub Copilot to Cline
  • Datadog to Netdata
  • Microsoft Teams to Rocket.Chat
  • Pinecone to Qdrant
  • Zapier to n8n
  • Devin AI to OpenHands
  • Firebase to Supabase
  • 1Password to KeePassXC
  • Confluence to Docmost
  • Contentful to Strapi
  • Adobe Premiere Pro to Shotcut
  • ChatGPT to AnythingLLM
  • LangSmith to Langfuse
  • Claude Code to OpenCode
  • Jira to Windshift
  • Notion to AppFlowy
  • Slack to Mattermost
  • Linear to GitLab
  • Wispr Flow to Handy
  • CapCut to Concat
  • Grok Bot to rakazo
  • Superhuman to Inbox Zero
  • Airtable to AITable
  • Muse to OpenClaw
  • GitHub Copilot to Cline
  • Datadog to Netdata
  • Microsoft Teams to Rocket.Chat
  • Pinecone to Qdrant
  • Zapier to n8n
  • Devin AI to OpenHands
  • Firebase to Supabase
  • 1Password to KeePassXC
  • Confluence to Docmost
  • Contentful to Strapi
  • Adobe Premiere Pro to Shotcut
  • ChatGPT to AnythingLLM
  • LangSmith to Langfuse