How to Run SkillSpector in Docker with API Keys Configured

You can run SkillSpector in Docker by building the image from the repository's Dockerfile, mounting your target directory to /scan, and supplying LLM provider credentials via environment variables or an .env file.

SkillSpector is NVIDIA's open-source security analysis framework for evaluating AI skills and code repositories. When you configure SkillSpector to run inside a Docker container with API keys, you eliminate Python dependency management on your host while maintaining full access to LLM-powered vulnerability detection. The containerized implementation uses the multi-stage Dockerfile at the repository root and respects the same credential handling patterns defined in src/skillspector/cli.py.

Build the Docker Image

The first step is creating the container image from the source code. The repository includes a Dockerfile that implements a two-stage build process: a builder stage installs the package into a virtual environment, and the final runtime stage copies only that virtual environment to minimize image size.

# From the repository root

make docker-build

Or build directly with Docker:

docker build -t skillspector .

The container's ENTRYPOINT is set to ["skillspector"], meaning any arguments you pass after the image name are forwarded directly to the CLI. This design ensures the Dockerized experience matches running the tool natively.

Configure API Credentials

SkillSpector requires LLM provider credentials to perform semantic analysis. The CLI reads these from environment variables exactly as implemented in src/skillspector/cli.py (lines 92-106). Create an .env file in your working directory using the template provided in .env.example.

Supported providers and their required variables:

• OpenAI: OPENAI_API_KEY
• Anthropic: ANTHROPIC_API_KEY
• NVIDIA: NVIDIA_INFERENCE_KEY

Additionally, set SKILLSPECTOR_PROVIDER to specify which backend to use (openai, anthropic, or nv_build).

Example .env file:

SKILLSPECTOR_PROVIDER=anthropic
ANTHROPIC_API_KEY=sk-ant-...

# OPENAI_API_KEY=sk-...          # Uncomment for OpenAI

# NVIDIA_INFERENCE_KEY=nvapi-... # Uncomment for NVIDIA

Execute the Container

Run the container by mounting the directory you want to scan to /scan (the container's working directory) and passing your credentials via --env-file or inline -e flags.

Static analysis only (no LLM required):

docker run --rm -v "$PWD:/scan" skillspector scan ./my-skill/ --no-llm

With LLM analysis using env file:

docker run --rm \
  -v "$PWD:/scan" \
  --env-file .env \
  skillspector scan ./my-skill/

With inline credentials:

docker run --rm \
  -v "$PWD:/scan" \
  -e SKILLSPECTOR_PROVIDER=openai \
  -e OPENAI_API_KEY="$OPENAI_API_KEY" \
  skillspector scan ./my-skill/

Because the Dockerfile sets ENTRYPOINT ["skillspector"], all arguments after the image name (scan ./my-skill/) are passed directly to the SkillSpector CLI.

Override Providers and Models (Optional)

You can override the model selection or point to local LLM servers using additional environment variables. Set SKILLSPECTOR_MODEL to force a specific model version, or configure OPENAI_BASE_URL to use OpenAI-compatible APIs like Ollama.

Using a specific model:

docker run --rm \
  -v "$PWD:/scan" \
  -e SKILLSPECTOR_PROVIDER=anthropic \
  -e ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY" \
  -e SKILLSPECTOR_MODEL=claude-3-opus-20240229 \
  skillspector scan ./my-skill/

Connecting to a local Ollama instance:

docker run --rm \
  -v "$PWD:/scan" \
  -e SKILLSPECTOR_PROVIDER=openai \
  -e OPENAI_API_KEY=ollama \
  -e OPENAI_BASE_URL=http://localhost:11434/v1 \
  -e SKILLSPECTOR_MODEL=llama3.1:8b \
  skillspector scan ./my-skill/

Summary

• Build the image using make docker-build or docker build -t skillspector . from the repository root, which uses the multi-stage Dockerfile.
• Configure credentials in an .env file or export them directly, specifying SKILLSPECTOR_PROVIDER and the appropriate API key (OPENAI_API_KEY, ANTHROPIC_API_KEY, or NVIDIA_INFERENCE_KEY).
• Mount your target directory to /scan when running the container to make files accessible to the scanner.
• Pass environment variables using --env-file .env or individual -e flags to provide the credentials required by src/skillspector/cli.py.

Frequently Asked Questions

Do I need Python installed on my host to run SkillSpector in Docker?

No. The Docker image contains a complete Python environment built from the Dockerfile. You only need Docker installed on your system. The container embeds all dependencies and runs the skillspector entrypoint directly.

Which environment variables are required for LLM analysis?

You must provide SKILLSPECTOR_PROVIDER set to openai, anthropic, or nv_build, plus the corresponding API key: OPENAI_API_KEY, ANTHROPIC_API_KEY, or NVIDIA_INFERENCE_KEY. These are read by the CLI parser in src/skillspector/cli.py and forwarded to the analysis engine.

How do I use a local LLM like Ollama with SkillSpector Docker?

Set SKILLSPECTOR_PROVIDER=openai, point OPENAI_BASE_URL to your local endpoint (e.g., http://localhost:11434/v1), and set OPENAI_API_KEY to any value (Ollama ignores it). You can also specify the model with SKILLSPECTOR_MODEL (e.g., llama3.1:8b).

Can I run SkillSpector without LLM analysis in Docker?

Yes. Append the --no-llm flag to your scan command. This performs static analysis only and does not require any API keys, making it suitable for air-gapped environments or CI pipelines where credential management is restricted.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}