# Can SkillSpector Analyze Skills Without an API Key? Static-Only Security Scanning Explained

> SkillSpector analyzes skills without an API key using static-only security scanning. Discover how to perform comprehensive local source code analysis with the --no-llm flag.

- Repository: [NVIDIA Corporation/SkillSpector](https://github.com/NVIDIA/SkillSpector)
- Tags: how-to-guide
- Published: 2026-06-21

---

**Yes, SkillSpector can analyze skills without an API key by disabling LLM-based analysis with the `--no-llm` flag, allowing comprehensive static and behavioral security checks to run using only local source code analysis.**

NVIDIA's SkillSpector is an open-source security framework designed to scan AI skills for vulnerabilities. While the tool supports LLM-powered semantic analysis, you can perform thorough security scans without OpenAI, Anthropic, or NVIDIA inference API keys by running in static-only mode.

## How SkillSpector Works Without an API Key

### The `--no-llm` Flag and Static Analysis

When you invoke SkillSpector with the `--no-llm` command-line flag, the CLI populates `use_llm=False` in the initial graph state at [`src/skillspector/cli.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/cli.py) lines 92-94. This boolean propagates through the LangGraph-based analysis pipeline, causing all LLM-driven nodes to skip execution entirely.

The framework then executes only **static analyzers** that perform:
- **YARA pattern matching** for known malicious signatures
- **MCP (Model Context Protocol) validation** 
- **Behavioral tracking** and taint analysis
- **Permission checks** on skill manifests

These analyzers operate purely on local source code and require no external credentials.

### Error Handling When API Keys Are Missing

If you attempt to run LLM analyzers without configuring an API key, the provider resolution logic in [`src/skillspector/providers/__init__.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/providers/__init__.py) invokes `raise_no_llm_api_key_configured()` at lines 50-53. This raises a clear `ValueError` with the message defined in `NO_LLM_API_KEY_MESSAGE`, preventing ambiguous failures or partial scans.

## Running SkillSpector Without an API Key

### Command-Line Interface

Run a complete static analysis scan without any API key:

```bash
skillspector scan ./my-skill/ --no-llm --format json -o report.json

```

The `--no-llm` flag disables all LLM-driven nodes. The generated [`report.json`](https://github.com/NVIDIA/SkillSpector/blob/main/report.json) contains findings from YARA, MCP, and other static checks.

### Programmatic Python API

You can also disable LLM analysis when using SkillSpector as a library:

```python
from skillspector.graph import graph

# Build state with LLM analysis disabled

state = {
    "skill_path": "/path/to/skill",
    "use_llm": False,          # Disable LLM requirement

    "output_format": "json",
}

result = graph.invoke(state)
print(result["filtered_findings"])   # Static-only findings

```

### Expected Error Without `--no-llm`

If you forget to disable LLM mode and have no API key configured:

```python
from skillspector.graph import graph

# This raises ValueError with NO_LLM_API_KEY_MESSAGE

result = graph.invoke({
    "skill_path": "/tmp/skill", 
    "use_llm": True
})

```

The call raises `ValueError` as implemented in [`src/skillspector/providers/__init__.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/providers/__init__.py) lines 42-47.

## Architecture Deep Dive

### CLI Parsing and State Initialization

In [`src/skillspector/cli.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/cli.py), the argument parser detects `--no-llm` and sets the initial state dictionary's `use_llm` key to `False` at lines 92-94. This state propagates to every node in the analysis graph, ensuring consistent behavior across the entire scanning session.

### Provider Validation Logic

The [`src/skillspector/providers/__init__.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/providers/__init__.py) file contains centralized LLM provider resolution. When `use_llm=True` but no credentials are found for the active provider, the code raises an explicit error at lines 50-53, halting execution before any external API calls are attempted.

### Analyzer Node Behavior

Individual analyzers respect the `use_llm` flag. For example, in [`src/skillspector/nodes/analyzers/semantic_developer_intent.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/semantic_developer_intent.py) lines 59-61, the semantic developer intent analyzer returns an empty findings list immediately when `use_llm=False`, bypassing credential-requiring LLM inference while allowing other analyzers to continue.

## Summary

- **SkillSpector analyzes skills without an API key** when you invoke it with `--no-llm` or set `use_llm=False` in the graph state.
- **Static analyzers** require no external credentials and detect vulnerability classes including malicious patterns, permission misconfigurations, and behavioral anomalies.
- **LLM semantic checks** are automatically bypassed in no-LLM mode, though they require API keys when enabled.
- **Clear error handling** via `raise_no_llm_api_key_configured()` prevents confusion when API keys are missing but LLM analysis is requested.

## Frequently Asked Questions

### What analysis features are lost without an API key?

Without an API key and LLM analysis disabled, SkillSpector skips the **semantic developer intent analyzer** and other LLM-driven nodes that interpret natural language descriptions or complex behavioral patterns. However, static pattern matching, permission validation, and behavioral taint analysis continue to function fully.

### Is static analysis sufficient for security scanning?

Yes, according to the integration tests in [`tests/integration/test_meta_analyzer_use_llm.py`](https://github.com/NVIDIA/SkillSpector/blob/main/tests/integration/test_meta_analyzer_use_llm.py) lines 25-33, static-only scans successfully identify security issues without API keys. While LLM analysis adds semantic depth for subtle vulnerabilities, static checks catch the majority of common misconfigurations and malicious code patterns.

### Can I use SkillSpector in CI/CD pipelines without API keys?

Absolutely. By setting `--no-llm` in your CI configuration, you can scan skill repositories in automated pipelines without exposing API keys or managing external service credentials. This approach is validated in the test suite at [`tests/integration/test_meta_analyzer_use_llm.py`](https://github.com/NVIDIA/SkillSpector/blob/main/tests/integration/test_meta_analyzer_use_llm.py) lines 64-73.

### Which LLM providers require API keys in SkillSpector?

SkillSpector supports OpenAI, Anthropic, and NVIDIA inference providers, all of which require valid API keys when `use_llm=True`. The provider resolution logic in [`src/skillspector/providers/__init__.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/providers/__init__.py) validates these credentials before attempting any LLM calls.