skill-inspector

skill-inspector

A sophisticated agentic tool built with Mastra to inspect AI Agent Skills for quality, security, and compatibility.

Features

• Automated Spec Validation: Ensures skills adhere to the agentskills.io specification.
• Deep Security Auditing: Two-phase agentic workflow to detect RCE, data exfiltration, and other vulnerabilities.
• Provider Compatibility: Analyzes skills for vendor-specific extensions to ensure portability across Claude, GPT-4, Gemini, and more.
• Smart Discovery: Automatically finds skills in local directories or remote GitHub repositories.
• Actionable Reports: Provides a clear 0-100 score with specific findings and proposed fixes.

Getting Started

Installation

You can run skill-inspector directly using npx:

npx skill-inspector inspect ./my-skill

Or install it globally:

# Using npm
npm install -g skill-inspector

# Using pnpm
pnpm add -g skill-inspector

# Using yarn
yarn global add skill-inspector

For Contributors

If you want to run the project locally for development:

# Install dependencies
pnpm install

# Build the project
pnpm build

# Run via pnpm dev
pnpm dev inspect ./my-skill

Usage

# Basic inspection of a local directory
skill-inspector inspect ./my-skill

# Inspect a remote GitHub repository
skill-inspector inspect anthropics/skills

# List found skills without inspecting
skill-inspector inspect ./my-skill --list

# Inspect specific skills by name
skill-inspector inspect anthropics/skills -s "git-commit" "test-and-fix"

# Choose a specific LLM provider and model
skill-inspector inspect ./my-skill --provider anthropic --model claude-3-5-sonnet-latest

# Output results as JSON for automation
skill-inspector inspect ./my-skill --json

# Debug mode (see detailed agent thoughts and logs)
skill-inspector inspect ./my-skill --debug

Inspect-Skills Agent Skill

This repository includes an Agent Skill (skills/inspect-skills) that lets AI coding agents (e.g. Cursor, Claude Code) run the inspector from within a session. Use it when you want an agent to validate skills, audit for security, or check spec compliance.

• List skills (no API key): run the skill’s scripts/list-skills.sh with a path or owner/repo.
• Full inspection: run scripts/inspect.sh with the same source and optional flags (e.g. --provider, --json). At least one LLM API key is required.

You can use the skill from this repo’s skills/inspect-skills/ directory, or install it with npx skills:

npx skills install skills/inspect-skills

LLM Configuration

The inspector supports multiple providers. Set your API keys as environment variables:

Provider	CLI Value	Default Model	API Key Env Var
OpenAI	openai	gpt-5-mini	OPENAI_API_KEY
Anthropic	anthropic	claude-4-5-haiku@20260315	ANTHROPIC_API_KEY
Google AI	google	gemini-2.5-flash	GOOGLE_API_KEY
Mistral	mistral	mistral-small-latest	MISTRAL_API_KEY
Groq	groq	llama-4-scout-17b	GROQ_API_KEY
Vertex AI	google-vertex	gemini-2.5-flash	GOOGLE_VERTEX_PROJECT, GOOGLE_VERTEX_LOCATION
Anthropic Vertex	anthropic-vertex	claude-4-5-haiku@20260315	GOOGLE_VERTEX_PROJECT, GOOGLE_VERTEX_LOCATION

Documentation

For technical details, architecture diagrams, and contribution guidelines, see CONTRIBUTING.md.

License

Apache-2.0