caniopen-sourceit

the catalog · 🔐 Security

SkillSpector

★ 15k

NVIDIA's scanner that statically checks AI agent skills (Claude Code, Codex, MCP) for vulnerabilities, prompt injection, and malicious patterns before you install them.

SkillSpector does the job of Snyk and Socket.dev, self-hosted. It is Apache-2.0-licensed, so you can do essentially what you like with it, and it installs in about one command. Snyk bills $25/mo for it. 15k stars on GitHub.

Open-source replacement for Snyk, Socket.dev.

Licence
Apache-2.0
Self-hosting
Easy
The paid one costs
$25/mo
GitHub stars
15k
view the code →official site →

Is it actually a replacement?

We have not written a verdict on Snyk or Socket.dev yet, so this page says what SkillSpector is rather than judging what you would give up. When that product gets a page, this one will link to it.

SkillSpector questions

Is SkillSpector open source?

Yes — it is released under Apache-2.0.

Can I self-host SkillSpector?

Yes — we rate it easy to self-host.

More security testing tools