Registry › Compare › REA vs SkillSpector

REA vs SkillSpector

REA leads on trust: 73.8/100 (Grade B) against 63.4/100 (Grade C), a 10.4-point gap. REA leads on provenance and supply-chain integrity, and rests on broader evidence; SkillSpector leads on maintenance and adoption.

B REA 73.8

Reverse engineer anything with agents, from app behavior down to native binaries.

morluto/rea · #246 overall · #4 Security & Guardrails · coverage B (3/5)

Choose REA if provenance and supply-chain integrity matter most.

+7.2Identity / Provenance: package provenance attested, against none
+4.9Safety / Integrity: package provenance attested, against none
B vs CEvidence coverage: 3 of 5 independent signal types, against 2

C SkillSpector 63.4

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.

NVIDIA/SkillSpector · #530 overall · #7 Security & Guardrails · coverage C (2/5)

Choose SkillSpector if maintenance and adoption matter most.

+7.3Maintenance: last push today, against 18d ago
+1.4Adoption: 18.3k GitHub stars against 415

Where they differ

15.9

Safety / IntegrityREA +4.9

11.0

18.0

Identity / ProvenanceREA +7.2

10.8

12.7

TransparencySkillSpector +0.3

13.0

12.7

MaintenanceSkillSpector +7.3

20.0

8.8

AdoptionSkillSpector +1.4

10.2

+5.7

Runtime calibrationREA +7.3

-1.6

Full evidence table

An independent, evidence-based trust comparison of REA and SkillSpector, two Security & Guardrails projects in the HVTracker registry. Scores come from public, checkable signals — supply-chain provenance, OSSF Scorecard, maintenance, and adoption — not popularity.

Full evidence

Signal	REAmorluto/rea	SkillSpectorNVIDIA/SkillSpector
HVTrust score	73.8	63.4
Evidence grade	B	C
Coverage grade	B	C
Overall rank	#246	#530
Rank in Security & Guardrails	#4	#7
GitHub stars	415	18.3k
Last updated	18d ago	today
Build provenance	Yes	No
OSSF Scorecard	4.9 / 10	5.3 / 10
License	MIT	Apache-2.0
Downloads	72/wk	—
Trust dimensions (points earned)
Safety / integrity / 25	15.9	11.0
Identity & provenance / 18	18.0	10.8
Transparency / 17	12.7	13.0
Maintenance / 20	12.7	20.0
Adoption / 20	8.8	10.2
Runtime capability surface (full matrix)
MCP server	Implemented	Implemented
External providers	—	5 — Amazon Bedrock, Anthropic, Azure OpenAI, …
Requires API keys	No	Yes
Plugin surface	—	extensions
Provenance drift	Match	—

Open in the live compare tool → REA profile SkillSpector profile More Security & Guardrails →

How to read this: HVTrust (0–100) weighs supply-chain signals (provenance, OSSF Scorecard, signed commits, open license) alongside real-world adoption, scaled by an evidence-confidence factor. Grade bands: A ≥ 80, B ≥ 65, C ≥ 50, D < 50. Signals refresh daily. Full methodology v4.3 →