SkillSpector Web
Engine v2.5.1
Niyogi Labs ↗ SkillSpector GitHub ↗

Inspect Any AI Agent Skill Directly in Your Browser

SkillSpector Web is a WebAssembly / browser port of SkillSpector maintained for user convenience by Niyogi Labs. It enables instant security analysis of AI agent skills (Claude Code skills, Cursor rules, MCP servers) hosted on GitHub for prompt injection, credential theft, malicious tools, and privilege escalation directly in your browser.

ℹ️ ⚡ No-LLM Mode: Performs 100% browser-executed static WASM pattern matching. No semantic LLM analysis will be performed. Select LM Studio, Ollama, or LiteLLM to enable secondary semantic AI auditing via your configured endpoint in Settings.
Quick Demos:
Fetching & Analyzing GitHub Skill Client-Side...
Executing static pattern rules & AST analyzers in browser engine
📁 Inspected Target Repository
owner/repo
owner/repo
Scanned 1 file, 45 lines
Files 0
Lines Scanned 0
Scan Time --:--
Overall Security Score
100 Risk Index
PASS
0 Critical
0 High
0 Medium
0 Low
0 Info
Vulnerability Category Breakdown
Select a file to inspect
Work ID File Path Outcome Lines Findings
Download Scan Reports & Baseline Suppressions
SARIF 2.1.0 JSON
Standard Static Analysis Results Interchange Format for GitHub Code Scanning & CI/CD tools.
Full Inspection JSON
Complete structured audit report including work ledger, findings, and risk metrics.
Markdown Security Report
Formatted human-readable Markdown summary suited for pull requests and documentation.
Baseline Suppressor YAML
Generate .skillspector-baseline.yaml file to suppress acknowledged findings.
❓ Frequently Asked Questions (FAQ) & Security Scanner Guide
What is SkillSpector Web? SkillSpector Web is an online, 100% browser-executed WebAssembly (WASM) security scanner for AI agent skills, Claude Code skills, Cursor rules, Model Context Protocol (MCP) servers, and custom agent prompts hosted on GitHub.
Is my source code uploaded or stored on any server? No. SkillSpector Web operates under a 100% Zero-Trust privacy model. Repository files are fetched directly via public GitHub APIs and scanned locally inside your browser memory using WebAssembly static analysis rules.
What security vulnerability categories does it inspect? SkillSpector Web inspects for Prompt Injection (P1–P8), Secret & Data Exfiltration (E1–E5), Privilege Escalation (PE1–PE3), Supply Chain Code Execution (SC1–SC3), Excessive Agency (EA1–EA4), and MCP Tool Poisoning (MCP1).
How do I connect my LiteLLM Proxy or OpenAI API key for semantic AI audits? Open "Settings & LiteLLM AI" in the navigation bar to select LiteLLM Localhost Proxy (http://localhost:4000), Enterprise Gateway, Ollama, or OpenRouter. Your credentials are sent directly from your browser to your endpoint and never stored on Niyogi Labs servers.