gitscape.ai: Skill for Claude Code

.agents/skills/nvidia-skillspector/SKILL.md

nvidia-skillspector is a skill for Claude Code, Codex from jmxt3/gitscape.ai. It costs 86 tokens per session (1,521 once invoked), scanned A, original, Apache-2.0.

A codebase guide for NVIDIA’s SkillSpector, a security scanner that checks AI-agent skills for vulnerabilities and malicious patterns. It covers the project’s Python, TypeScript, and Shell code.

In plain words
What is it for?
Use it to navigate, extend, or debug SkillSpector, including its language checks, issue annotations, and API-key management code.
Why use it?
It helps an agent understand this specific repository before changing or debugging it, reducing confusion about its structure and public interfaces.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: installed under .agents/ (shared by several agents).

This is jmxt3/gitscape.ai's own configuration. It tells Claude Code and Codex how to work on gitscape.ai itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything gitscape.ai configures →

Reuse

Borrowing it

Nothing to install: this file belongs to jmxt3/gitscape.ai. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/jmxt3/gitscape.ai/main/.agents/skills/nvidia-skillspector/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/jmxt3/gitscape.ai

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for nvidia-skillspector

README.md
[![agentmods](https://agentmods.dev/badge/skills/jmxt3/gitscape.ai/nvidia-skillspector/github.svg)](https://agentmods.dev/skills/jmxt3/gitscape.ai/nvidia-skillspector)
Your own site
<a href="https://agentmods.dev/skills/jmxt3/gitscape.ai/nvidia-skillspector"><img src="https://agentmods.dev/badge/skills/jmxt3/gitscape.ai/nvidia-skillspector/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for nvidia-skillspector

Your own site · 80×15
<a href="https://agentmods.dev/skills/jmxt3/gitscape.ai/nvidia-skillspector"><img src="https://agentmods.dev/badge/skills/jmxt3/gitscape.ai/nvidia-skillspector.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 86 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,521 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00086 $0.01521
Opus 5 $0.00043 $0.00760
Sonnet 5 $0.00017 $0.00304
Haiku 4.5 $0.00009 $0.00152

Measured 10d ago against content hash d135bb6b74f9, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

nvidia-skillspector scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

The scan reads SKILL.md. This mod also ships 2 executable files (exporters/nvidia_skillspector_adk_skill.py, exporters/nvidia_skillspector_agno_skill.py), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/nvidia-skillspector/SKILL.md · 103 lines

How it starts

The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Skillspector Code Skill

Overview

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills.

Top-level areas: .github/, contrib/, docs/, extensions/, src/, tests/.

Primary languages: Python, TypeScript, Shell. The codebase contains 282 public symbols across 69 source files.

Key symbols:

  • is_language_compatible def is_language_compatible(rule_id: str, detected_language: str) -> bool — Return True when rule_id is reliable for detected_language.
  • annotate_findings def annotate_findings( issues: list[dict[str, object]], detected_language: str, ) -> list[dict[str, object]] — Add a language_compatible field to each issue dict.
  • ApiKey class ApiKey — A single API key with concurrency and rate-limit metadata.
  • ApiKey.available def available(self) -> boolTrue when this key can accept at least one more caller.
  • ApiKeyPool class ApiKeyPool — Thread-safe pool of API keys with per-key concurrency slots.
  • ApiKeyPool.__init__ def __init__(self, keys: list[ApiKey]) -> None
  • ApiKeyPool.acquire def acquire(self, timeout: float | None = None) -> ApiKey — Acquire a slot on the least-loaded available key.
  • ApiKeyPool.try_acquire def try_acquire(self) -> ApiKey | None — Non-blocking acquire — returns a key immediately or None.
  • ApiKeyPool.release def release(self, key: ApiKey, *, success: bool = True) -> None — Release a slot on key back to the pool.
  • ApiKeyPool.record_retry_success def record_retry_success(self) -> None — Increment the retry-success counter for reporting.
  • ApiKeyPool.rate_limits_hit def rate_limits_hit(self) -> int — Total number of 429 responses encountered across all keys.
  • ApiKeyPool.retry_successes def retry_successes(self) -> int — Total number of successful retries after a key switch.
  • ApiKeyPool.keys_configured def keys_configured(self) -> int — Total number of keys in the pool.
  • ApiKeyPool.total_capacity def total_capacity(self) -> int — Sum of max_concurrent across all keys.
  • ApiKeyPool.active_requests def active_requests(self) -> int — Total active requests across all keys.
  • ApiKeyPool.snapshot def snapshot(self) -> dict[str, object] — Return a snapshot dict suitable for report metadata.
  • PooledChatModel class PooledChatModel — LangChain-compatible chat model wrapper with transparent key switching.
  • PooledChatModel.__init__ def __init__( self, pool: ApiKeyPool, *, max_tokens: int = 4096, timeout: float = 30.0, max_retries: int = _MAX_RATE_LIMIT_RETRIES, ) -> None
  • PooledChatModel.invoke def invoke(self, prompt: str) -> object — Synchronous invoke with automatic key switching on rate-limit.
  • PooledChatModel.ainvoke def ainvoke(self, prompt: str) -> object — Async invoke with automatic key switching on rate-limit.

Read the full file on GitHub · 103 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 10d ago First seen · 103 lines · 86 tokens per session scan A d135bb6b74f9

Subscribe to this mod's changes

nvidia-skillspector is a skill published in the GitHub repository jmxt3/gitscape.ai (33 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 86 tokens to every session and 1,521 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

ultralytics-platform

This skill should be used when user asks to "upload my model to Ultralytics Platform", "push this run to the platform", "upload a dataset to platform", "download a dataset from platform", "search platform datasets", "start cloud training", "train on platform GPUs", "export a model on platform", "deploy a model…

fcakyon/claude-codex-settings · 112 tokens

mindos

Operate a MindOS knowledge base: update notes, search, organize files, execute SOPs/workflows, retrospective, append CSV, cross-agent handoff, route unstructured input to the right files, distill experience, sync related docs. Use when the task targets files inside the user's MindOS KB (mindRoot). NOT for editing app…

GeminiLight/MindOS · 157 tokens

mongodb-query-optimizer

Help with MongoDB query optimization and indexing. Use only when the user asks for optimization or performance: "How do I optimize this query?", "How do I index this?", "Why is this query slow?", "Can you fix my slow queries?", "What are the slow queries on my cluster?", etc. Do not invoke for general MongoDB query…

fcakyon/claude-codex-settings · 98 tokens

github-image-upload

Upload local images and other files (PDF, zip, log, …) to GitHub and embed them in a pull request description, an issue, or a comment — producing canonical github.com/user-attachments URLs (private-repo uploads stay private). Use when asked to "attach a screenshot to the PR", "add an image to the PR description", "put…

drogers0/gh-image · 135 tokens

rag-retrieval

Retrieval-Augmented Generation patterns for grounded LLM responses. Use when building RAG pipelines, embedding documents, implementing hybrid search, contextual retrieval, HyDE, agentic RAG, multimodal RAG, query decomposition, reranking, or pgvector search.

yonatangross/orchestkit · 58 tokens

github

GitHub operations via gh CLI: issues, PRs, CI runs, code review, API queries.

AIOSAI/AIPass · 23 tokens