AgentToolDrop

14 of 48

SkillSpector

Scans agent skills for prompt injection, data exfiltration and supply-chain risks before you install them

  • score 51
  • 20.2k stars
  • 97.1 stars/day since creation
  • pushed
  • v2.12.0 on
  • Apache-2.0

Install with uv

uv tool install git+https://github.com/NVIDIA/skillspector.git

Copied from the project's docs at github.com/NVIDIA/SkillSpector

Why you'd want it

SkillSpector scans a skill from a Git repo, URL, zip file, directory or single SKILL.md against 71 patterns in 17 categories, including prompt injection, data exfiltration, privilege escalation, MCP tool poisoning and MCP least privilege. It runs static analysis first and an optional LLM evaluation second, gives a 0 to 100 risk score, and writes terminal, JSON, Markdown or SARIF reports. It can also run as an MCP server with a scan_skill tool, so Claude Code, Codex CLI or Gemini CLI can gate skill and MCP installs on the result. It is part of NVIDIA's Verified Skills pipeline.

Best for

  • Vetting third-party skills before install
  • CI checks with SARIF output
  • Gating installs from inside an agent

Use it when

You install skills or MCP servers from public repositories and want a report on risky patterns before they reach your agent.

Skip it if

You only use skills you wrote yourself. The optional LLM analysis sends skill content to the configured provider with your API key; --no-llm runs static checks only. The README notes the stdio MCP transport still has an initialize hang reported in issue #199.

Editor's note

The MCP server needs the mcp extra: uv tool install 'skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git', then skillspector mcp.

Related tools

Same category or shared tags.

  1. Rank 11

    text-to-cad

    Devtool

    Gives an agent skills to generate 3D models as STEP, STL, 3MF or GLB and run manufacturing checks

    • score 54
    • 20.6k stars
    • 117 stars/day since creation
    • pushed
    • v0.7.21 on
    • MIT

    Install the Claude Code plugin

    claude plugin marketplace add earthtojake/text-to-cad#latest
claude plugin install text-to-cad@earthtojake
    Use it when, skip it if, stats for text-to-cad

    Why you'd want it

    text-to-cad is a plugin and skill set that gives an agent local workflows for generating 3D models as STEP, GLB, STL or 3MF files. Its skills also cover design for manufacturing checks, engineering drawings, 2D DXF files, URDF, SRDF and SDF robot and simulator files, and slicing to G-code with OrcaSlicer. Models open in a CAD Viewer, shown as a card in the conversation where the app supports it or as a browser link otherwise. The README says it works with agents that support plugins or the skills framework, including Claude Code, Codex, Cursor, Gemini and Grok.

    Best for

    • Prompting an agent to model printable parts
    • DFM and printability checks before fabrication
    • Robot description files for URDF and SDF

    Use it when

    You want a coding agent to produce and edit CAD files from plain-language or image requests, then check them for 3D printing, sheet metal or CNC before sending them out.

    Skip it if

    You do not want telemetry: usage stats and crash reports are on by default with a random install ID, and you turn them off with uvx cadgen telemetry off. It needs uv installed, downloads its CAD runtime on first start, and runs a local server and a browser viewer. Its skills can send prints to Bambu Lab printers, so review what an agent may do there. Releases are still 0.x (v0.7.21), and on Windows 11 with Smart App Control on, the README says CAD commands fail unless you turn it off or use WSL.

    Stats

    New and rising score
    54 of 100
    Stars per day, since repo creation
    117
    Release
    v0.7.21,
    License
    MIT
    Pricing
    Open source
    Works with
    Claude Code, Codex, Cursor, Gemini CLI, Claude Desktop
    Forks
    2,032
    Open issues
    44
    GitHub checked

    Full stat block for text-to-cad

  2. Rank 12

    OfficeCLI

    Devtool

    CLI that lets agents create, read and edit Word, Excel and PowerPoint files without Office installed

    • score 52
    • 32k stars
    • 150 stars/day since creation
    • pushed
    • v1.0.157 on
    • Apache-2.0

    Install with Homebrew

    brew install officecli
    Use it when, skip it if, stats for OfficeCLI

    Why you'd want it

    OfficeCLI is a single binary that creates, reads and modifies .docx, .xlsx and .pptx files from the command line, with no Office installation needed. Every command supports --json output and elements are addressed by paths such as /slide[1]/shape[2], so an agent does not have to handle OOXML namespaces. It can render documents to HTML or PNG so an agent can look at its output and fix layout, and it evaluates Excel formulas on write. It also ships template merge for {{key}} placeholders, a dump command that turns a document into replayable batch JSON, and a built-in MCP server.

    Best for

    • Agent-generated decks, reports and spreadsheets
    • Batch edits and template fill in CI
    • Extracting document content to JSON

    Use it when

    You want an agent to produce or edit Word, Excel or PowerPoint files from a shell or over MCP, including in headless or Docker environments with no Office install.

    Skip it if

    You are wary of piping a script into your shell; the README's one-line installer is curl into bash, and a package manager or manual download is also listed. The install step also writes a skill file into every agent config it detects, checks for updates in the background by default, and view screenshot pipes rendered HTML through a headless browser while watch starts a local HTTP server. The README's claims of being the first and best, its fidelity claims and its comparison table are the project's own and were not checked here, so test your own documents first. The raw XML commands can rewrite document parts directly.

    Stats

    New and rising score
    52 of 100
    Stars per day, since repo creation
    150
    Release
    v1.0.157,
    License
    Apache-2.0
    Pricing
    Open source
    Works with
    Claude Code, Cursor, Codex, Windsurf, VS Code, macOS, Linux, Windows
    Forks
    2,184
    Open issues
    91
    GitHub checked

    Full stat block for OfficeCLI

  3. Rank 39

    Repomix

    Devtool

    Packs a repository into one AI-friendly file in XML, Markdown, JSON or plain text

    • score 26
    • 28.8k stars
    • 35 stars/day since creation
    • pushed
    • v1.18.1 on
    • MIT

    Run with npx

    npx repomix@latest
    Use it when, skip it if, stats for Repomix

    Why you'd want it

    Repomix reads a local or remote repository, respects .gitignore and .repomixignore, uses Secretlint to leave out files that match known credential formats, and writes one file with a summary, directory structure and file contents, plus token counts per file. The --compress option uses Tree-sitter to keep key code elements with fewer tokens, and large outputs can be split into parts. It also runs as an MCP server (repomix --mcp) and can generate Claude Agent Skills from a codebase.

    Best for

    • Feeding a whole codebase to a chat model
    • Checking token counts before sending context
    • Packing a remote GitHub repo for reference

    Use it when

    You want to hand an LLM a full or filtered snapshot of a repository in one file, or let an agent pack repos through MCP.

    Skip it if

    Your coding agent already reads files in your workspace and you have no need for a single packed file. By default the MCP server can read any path the host user can, so use --sandbox with untrusted clients.

    Stats

    New and rising score
    26 of 100
    Stars per day, since repo creation
    35
    Release
    v1.18.1,
    License
    MIT
    Pricing
    Open source
    Works with
    Any MCP client, Claude Code, Cursor, VS Code, Claude Desktop, Docker, Web
    Forks
    1,592
    Open issues
    153
    GitHub checked

    Full stat block for Repomix

For agents

The same entry, as files an agent can read without scraping this page. 

# read one entry
curl -s https://agenttooldrop.com/tools/skillspector.md

# list the MCP servers in the catalog
curl -s https://agenttooldrop.com/tools.json \
  | jq -r '.tools[] | select(.category=="mcp-server") | .slug'