NVIDIA SkillSpector is a new open-source tool built to solve a problem that’s grown alongside AI agents like Claude Code, Codex CLI, and Gemini CLI: these agents can now be extended with “skills” — bundles of instructions and executable scripts anyone can download and install — and those skills run with the same permissions as the person who installed them. That convenience comes with a real security gap. In this guide, we break down exactly what NVIDIA SkillSpector does, how it works, and how to run it yourself, and we point to the official GitHub repository so you can follow along.

Summary

NVIDIA SkillSpector is a free, open-source command-line scanner that analyzes AI agent skills — whether they come from a GitHub repo, a zip file, a folder, or a single file — and tells you whether the skill is safe to install by detecting 64 distinct vulnerability patterns across 16 risk categories, then issuing a 0–100 risk score.

Table of Contents

1. What Is NVIDIA SkillSpector?
2. Why AI Agent Skills Are a Growing Security Risk
3. How SkillSpector Works: The Two-Stage Pipeline
4. The 16 Vulnerability Categories, Explained
5. How the Risk Score Is Calculated
6. Full Installation and Command Guide
7. What a Real Scan Report Looks Like
8. Current Limitations
9. Why This Matters for Developers and Businesses
10. Conclusion

---

What Is NVIDIA SkillSpector?

SkillSpector is an Apache 2.0-licensed, open-source security scanner built by NVIDIA specifically for the emerging world of “agent skills.” Unlike a typical prompt, a skill usually pairs plain-language instructions with real, executable code — meaning a malicious skill isn’t just misleading text, it’s software with system access.

SkillSpector’s job is simple to state but hard to do well: read a skill before it’s installed and answer one question honestly — is this safe to run on my machine?

Who Built It, and Why

The project comes out of NVIDIA’s broader push into agentic AI security, part of what the company calls its Verified Agent Skills ecosystem. That ecosystem also includes a curated catalog of signed, human-reviewed skills, but SkillSpector itself is meant to work independently, scanning any skill from any source — not just NVIDIA’s own catalog.

Why AI Agent Skills Are a Growing Security Risk

The research behind the NVIDIA SkillSpector release is sobering. A study titled “Agent Skills in the Wild,” which analyzed over 42,000 skills pulled from major marketplaces, found that roughly one in four contained at least one security vulnerability, and a smaller but meaningful share showed signs of intentional malicious design.

The Core Problem: Implicit Trust

Most agent frameworks don’t sandbox skills by default. When an agent loads a skill, it typically inherits the user’s full file system access, environment variables, and network permissions. A skill that quietly reads a .env file or an SSH key and phones home to an external server can do so without any visible warning sign to the user.

Scripts Multiply the Risk

Skills that ship with an executable script alongside their instructions were found to be over twice as likely to contain a vulnerability compared to instruction-only skills. That single data point is a big part of why SkillSpector treats executable code as a major risk multiplier in its scoring system.

How SkillSpector Works: The Two-Stage Pipeline

SkillSpector doesn’t rely on a single detection method. It combines fast, deterministic static analysis with an optional, context-aware AI review layer.

Stage 1 — Static Analysis (Always On)

This first pass runs in seconds and requires no API key or internet connection beyond an optional dependency check. It combines several techniques:

• Regex pattern matching across 64 known vulnerability signatures
• AST (Abstract Syntax Tree) analysis that flags dangerous function calls like exec(), eval(), and subprocess
• Taint tracking, which traces how data moves — for example, following a value from an environment variable all the way to a network request
• YARA signature matching against known malware, webshells, and cryptomining code
• Live dependency checks against the OSV.dev vulnerability database, batched into a single request so no API key is needed

Stage 2 — LLM Semantic Analysis (Optional)

Static analysis is fast but sometimes flags harmless code that merely resembles a risky pattern. Stage 2 hands flagged findings to a large language model, which reads the code in its actual context, decides whether the concern is legitimate, and writes a plain-language explanation. This step reportedly pushes detection precision up to roughly 87%, and it includes built-in protections designed to stop a malicious skill from trying to manipulate the reviewing model itself.

Because this stage is optional, teams that want the fastest possible check can skip it entirely and rely on static analysis alone.

The 16 Vulnerability Categories, Explained

SkillSpector organizes its 64 detection rules into 16 categories. Here’s a plain-language tour of the ones most relevant to everyday users.

Prompt Injection and Behavior Manipulation

These rules catch hidden or disguised instructions — text buried in comments, invisible characters, or subtly worded phrasing designed to make an agent ignore its safety constraints or act against the user’s interests.

Data Exfiltration

This category flags code that harvests environment variables, scans the file system for sensitive files, or transmits conversation context to an external server — essentially, digital pickpocketing.

Privilege Escalation and Credential Access

Rules here look for skills requesting far more access than their stated purpose requires, invoking elevated system privileges, or directly reading SSH keys, tokens, and passwords.

Supply Chain Risks

This covers unpinned or abandoned dependencies, packages with known CVEs, typosquatted package names, and the classic red flag of piping a downloaded script straight into a shell.

Excessive Agency

Skills that grant themselves unrestricted tool access, make high-impact decisions without a human in the loop, or quietly expand beyond their advertised scope fall into this bucket.

Memory Poisoning and Rogue Agent Behavior

These newer categories address AI-specific threats: content designed to persist across sessions and corrupt future interactions, or code that modifies itself or installs unauthorized persistence mechanisms like cron jobs.

MCP Tool Poisoning

For skills built on the Model Context Protocol, this category catches sneaky tricks like Unicode homoglyphs, hidden HTML comments, or mismatches between what a tool claims to do and what its code actually does.

How the Risk Score Is Calculated

Every finding SkillSpector detects adds points to a running total, weighted by severity:

• Critical issues: +50 points
• High issues: +25 points
• Medium issues: +10 points
• Low issues: +5 points

If the skill includes executable scripts, the entire score is then multiplied by 1.3, reflecting the elevated risk that real code — versus plain instructions — introduces.

Score Range	Severity	Recommendation
0–20	Low	Safe
21–50	Medium	Caution
51–80	High	Do not install
81–100	Critical	Do not install

Anything landing above 50 is treated as unsafe by default, which gives teams a clear, consistent line to enforce automatically in CI/CD pipelines.

Full Installation and Command Guide

Here’s everything you need to get SkillSpector running locally.

Requirements

• Python 3.12 or later
• git
• Either uv (recommended) or pip

Step 1: Clone and Install

# Clone the repository
git clone https://github.com/NVIDIA/skillspector.git
cd skillspector

# Create and activate a virtual environment
uv venv .venv && source .venv/bin/activate
# or, without uv:
python3 -m venv .venv && source .venv/bin/activate

# Install for production use
make install

# Or install with development dependencies
make install-dev

Step 2: Run Your First Scan

# Scan a local skill folder
skillspector scan ./my-skill/

# Scan a single SKILL.md file
skillspector scan ./SKILL.md

# Scan a public Git repository directly by URL
skillspector scan https://github.com/user/my-skill

# Scan a compressed zip archive
skillspector scan ./my-skill.zip

Step 3: Choose an Output Format

# Terminal output (default, human-readable)
skillspector scan ./my-skill/

# JSON output for automation
skillspector scan ./my-skill/ --format json --output report.json

# Markdown output for documentation
skillspector scan ./my-skill/ --format markdown --output report.md

# SARIF output for CI/CD and IDE integration
skillspector scan ./my-skill/ --format sarif --output report.sarif

Step 4 (Optional): Enable Deeper AI Analysis

SkillSpector supports OpenAI, Anthropic, NVIDIA’s own build.nvidia.com gateway, and any locally hosted OpenAI-compatible server such as Ollama or vLLM.

# Using OpenAI
export SKILLSPECTOR_PROVIDER=openai
export OPENAI_API_KEY=sk-...
skillspector scan ./my-skill/

# Using Anthropic
export SKILLSPECTOR_PROVIDER=anthropic
export ANTHROPIC_API_KEY=sk-ant-...
skillspector scan ./my-skill/

# Using NVIDIA's build.nvidia.com
export SKILLSPECTOR_PROVIDER=nv_build
export NVIDIA_INFERENCE_KEY=nvapi-...
skillspector scan ./my-skill/

# Using a local model via Ollama
export SKILLSPECTOR_PROVIDER=openai
export OPENAI_API_KEY=ollama
export OPENAI_BASE_URL=http://localhost:11434/v1
export SKILLSPECTOR_MODEL=llama3.1:8b
skillspector scan ./my-skill/

# Skip AI analysis entirely for a faster, static-only check
skillspector scan ./my-skill/ --no-llm

Bonus Commands

# List every vulnerability pattern the tool checks for
skillspector patterns

# See all available scan options
skillspector scan --help

What a Real Scan Report Looks Like

When SkillSpector finds a problem, it doesn’t just throw a generic warning — it shows the file, the line number, the specific finding, a confidence percentage, and a plain explanation of why it matters. A skill secretly collecting environment variables and posting them to an external URL, for example, would trigger two linked findings — one for harvesting the data, one for transmitting it — with the tool explicitly noting how the two combine into a credential-theft pattern.

This level of detail matters because it lets a human reviewer make an informed decision quickly, rather than digging through hundreds of lines of unfamiliar code themselves.

Current Limitations

No scanner is perfect, and SkillSpector’s own documentation is upfront about where it currently falls short:

• Non-English content may not trigger the same detection patterns
• Text hidden inside images isn’t analyzed
• Encrypted or compiled code can’t be inspected
• Runtime-only behavior — things a skill only does once it’s actually executing — falls outside the reach of static analysis
• Offline dependency checks fall back to a smaller built-in list if there’s no internet access to the CVE database

None of these gaps are disqualifying, but they’re worth knowing before treating a clean scan as an absolute guarantee.

Why This Matters for Developers and Businesses

The rise of agent skills mirrors what happened with npm and PyPI packages a decade ago: an explosion of convenient, reusable code paired with a slower-to-mature security culture around vetting it. The difference this time is that agent skills often run with broader system access and act on the user’s behalf, which raises the stakes of a bad install.

For solo developers, NVIDIA SkillSpector offers a quick sanity check before trusting a random GitHub skill. For security teams, its SARIF and JSON output formats mean it can slot directly into existing DevSecOps pipelines, automatically blocking any skill that crosses a risk threshold before it ever reaches a production agent. If you’re new to hardening AI workflows in general, our beginner’s guide to AI agent security is a good next stop.

Conclusion

NVIDIA SkillSpector fills a real and fast-growing gap in AI tooling: a dedicated, purpose-built way to vet the skills that increasingly power autonomous agents. By combining rapid static analysis with an optional AI-driven second opinion, NVIDIA SkillSpector gives developers a practical, actionable answer to a question that’s only going to become more important — is this skill actually safe to install? With 64 detection patterns, transparent risk scoring, and support for multiple output formats, it’s a tool worth adding to any AI development workflow where third-party skills are part of the picture. You can explore the full source code and documentation on the NVIDIA SkillSpector GitHub page.