# How to Run SkillSpector in Docker with API Keys Configured

> Run SkillSpector in Docker easily. Configure API keys via environment variables or an env file for seamless LLM scanning. Get started now!

- Repository: [NVIDIA Corporation/SkillSpector](https://github.com/NVIDIA/SkillSpector)
- Tags: how-to-guide
- Published: 2026-06-15

---

**You can run SkillSpector in Docker by building the image from the repository's `Dockerfile`, mounting your target directory to `/scan`, and supplying LLM provider credentials via environment variables or an `.env` file.**

SkillSpector is NVIDIA's open-source security analysis framework for evaluating AI skills and code repositories. When you configure SkillSpector to run inside a Docker container with API keys, you eliminate Python dependency management on your host while maintaining full access to LLM-powered vulnerability detection. The containerized implementation uses the multi-stage `Dockerfile` at the repository root and respects the same credential handling patterns defined in [`src/skillspector/cli.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/cli.py).

## Build the Docker Image

The first step is creating the container image from the source code. The repository includes a `Dockerfile` that implements a two-stage build process: a builder stage installs the package into a virtual environment, and the final runtime stage copies only that virtual environment to minimize image size.

```bash

# From the repository root

make docker-build

```

Or build directly with Docker:

```bash
docker build -t skillspector .

```

The container's `ENTRYPOINT` is set to `["skillspector"]`, meaning any arguments you pass after the image name are forwarded directly to the CLI. This design ensures the Dockerized experience matches running the tool natively.

## Configure API Credentials

SkillSpector requires LLM provider credentials to perform semantic analysis. The CLI reads these from environment variables exactly as implemented in [`src/skillspector/cli.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/cli.py) (lines 92-106). Create an `.env` file in your working directory using the template provided in `.env.example`.

Supported providers and their required variables:

- **OpenAI**: `OPENAI_API_KEY`
- **Anthropic**: `ANTHROPIC_API_KEY`
- **NVIDIA**: `NVIDIA_INFERENCE_KEY`

Additionally, set `SKILLSPECTOR_PROVIDER` to specify which backend to use (`openai`, `anthropic`, or `nv_build`).

Example `.env` file:

```text
SKILLSPECTOR_PROVIDER=anthropic
ANTHROPIC_API_KEY=sk-ant-...

# OPENAI_API_KEY=sk-...          # Uncomment for OpenAI

# NVIDIA_INFERENCE_KEY=nvapi-... # Uncomment for NVIDIA

```

## Execute the Container

Run the container by mounting the directory you want to scan to `/scan` (the container's working directory) and passing your credentials via `--env-file` or inline `-e` flags.

**Static analysis only (no LLM required):**

```bash
docker run --rm -v "$PWD:/scan" skillspector scan ./my-skill/ --no-llm

```

**With LLM analysis using env file:**

```bash
docker run --rm \
  -v "$PWD:/scan" \
  --env-file .env \
  skillspector scan ./my-skill/

```

**With inline credentials:**

```bash
docker run --rm \
  -v "$PWD:/scan" \
  -e SKILLSPECTOR_PROVIDER=openai \
  -e OPENAI_API_KEY="$OPENAI_API_KEY" \
  skillspector scan ./my-skill/

```

Because the Dockerfile sets `ENTRYPOINT ["skillspector"]`, all arguments after the image name (`scan ./my-skill/`) are passed directly to the SkillSpector CLI.

## Override Providers and Models (Optional)

You can override the model selection or point to local LLM servers using additional environment variables. Set `SKILLSPECTOR_MODEL` to force a specific model version, or configure `OPENAI_BASE_URL` to use OpenAI-compatible APIs like Ollama.

**Using a specific model:**

```bash
docker run --rm \
  -v "$PWD:/scan" \
  -e SKILLSPECTOR_PROVIDER=anthropic \
  -e ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY" \
  -e SKILLSPECTOR_MODEL=claude-3-opus-20240229 \
  skillspector scan ./my-skill/

```

**Connecting to a local Ollama instance:**

```bash
docker run --rm \
  -v "$PWD:/scan" \
  -e SKILLSPECTOR_PROVIDER=openai \
  -e OPENAI_API_KEY=ollama \
  -e OPENAI_BASE_URL=http://localhost:11434/v1 \
  -e SKILLSPECTOR_MODEL=llama3.1:8b \
  skillspector scan ./my-skill/

```

## Summary

- **Build the image** using `make docker-build` or `docker build -t skillspector .` from the repository root, which uses the multi-stage `Dockerfile`.
- **Configure credentials** in an `.env` file or export them directly, specifying `SKILLSPECTOR_PROVIDER` and the appropriate API key (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, or `NVIDIA_INFERENCE_KEY`).
- **Mount your target** directory to `/scan` when running the container to make files accessible to the scanner.
- **Pass environment variables** using `--env-file .env` or individual `-e` flags to provide the credentials required by [`src/skillspector/cli.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/cli.py).

## Frequently Asked Questions

### Do I need Python installed on my host to run SkillSpector in Docker?

No. The Docker image contains a complete Python environment built from the `Dockerfile`. You only need Docker installed on your system. The container embeds all dependencies and runs the `skillspector` entrypoint directly.

### Which environment variables are required for LLM analysis?

You must provide `SKILLSPECTOR_PROVIDER` set to `openai`, `anthropic`, or `nv_build`, plus the corresponding API key: `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, or `NVIDIA_INFERENCE_KEY`. These are read by the CLI parser in [`src/skillspector/cli.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/cli.py) and forwarded to the analysis engine.

### How do I use a local LLM like Ollama with SkillSpector Docker?

Set `SKILLSPECTOR_PROVIDER=openai`, point `OPENAI_BASE_URL` to your local endpoint (e.g., `http://localhost:11434/v1`), and set `OPENAI_API_KEY` to any value (Ollama ignores it). You can also specify the model with `SKILLSPECTOR_MODEL` (e.g., `llama3.1:8b`).

### Can I run SkillSpector without LLM analysis in Docker?

Yes. Append the `--no-llm` flag to your scan command. This performs static analysis only and does not require any API keys, making it suitable for air-gapped environments or CI pipelines where credential management is restricted.