NVIDIA has released SkillSpector, an open-source security scanner that reads an AI agent skill and tells you whether installing it is a good idea. It lands on a real problem: skills are small packages that agents load to gain new abilities, they can carry scripts with broad access to your machine, and a marketplace of them is a software supply chain. For the wider topic, see our AI agent security guide.
The tool is genuinely useful. It is also, by its own design, not a guarantee. Both things are worth saying plainly.
What SkillSpector checks
The README describes 68 vulnerability patterns across 17 categories: prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, excessive agency, output handling, system prompt leakage, memory poisoning, tool misuse, rogue agent, trigger abuse, behavioral AST, taint tracking, YARA signatures, MCP least privilege and MCP tool poisoning. The first pass is static - nothing is executed. An AST walk flags constructs like exec, eval, subprocess calls and dynamic imports. A taint tracker follows environment variables and file contents towards network sinks. YARA rules match known malware signatures.
That list matters because it is shaped around how skills actually go wrong. Prompt injection, system prompt leakage and memory poisoning are not classic application vulnerabilities; they exist because the thing loading the skill is a language model. Scanning a skill with a generic code scanner would miss most of them.
Running it
Installation and use are a single command each. The project is published under the Apache License 2.0:
uv tool install git+https://github.com/NVIDIA/skillspector.git
skillspector scan ./my-skill/
skillspector scan ./SKILL.md
skillspector scan https://github.com/user/my-skill
skillspector scan ./my-skill.zip
skillspector scan ./my-skill/ --format json --output report.json
skillspector scan ./my-skill/ --no-llm
It accepts a directory, a single SKILL.md, a ZIP archive or a Git URL - which matters, because it means you can scan a skill straight from its repository before it ever touches your disk. JSON output makes it usable in a pipeline rather than only at a prompt.
The optional second pass
There is a second, slower pass that is off until you configure it. It needs an OpenAI-compatible endpoint and a key, set through SKILLSPECTOR_PROVIDER (which defaults to NVIDIA's own build endpoint) and optionally SKILLSPECTOR_MODEL. With it wired up, a language model reads the flagged code in context, drops false positives and writes an explanation a human can act on. The README puts the resulting precision at around 87%.
Read that number carefully. 87% precision is a statement about false positives, not about catching everything. It says most of what the tool reports is real. It says nothing about what it missed.
Why a scanner cannot be the whole answer
This is where our own reporting matters. In July we covered SkillCloak, a payload-preserving evasion framework: it keeps a malicious skill's behaviour intact while changing how it looks to a scanner. Across eight scanners and 1,613 in-the-wild malicious skills, self-extracting packing bypassed every scanner at over 90%, and structural obfuscation exceeded 80% on most static scanners. The full write-up is in AI agent skills are a new malware supply chain.
SkillSpector is a static scanner with an optional semantic pass. It is a better one than most, and the MCP-specific categories suggest the team knows where the modern risk is. But the class of attack SkillCloak demonstrated is precisely the class that defeats scanning at install time: the payload is not there yet when you scan, and it is rebuilt when the agent runs.
Where it fits anyway
A scanner that can be evaded is not a useless scanner. It raises the cost of an attack and catches the careless majority, which is most of what actually circulates. The sensible place for SkillSpector is in a pipeline: scan every skill before it enters your environment, fail the build on high-severity findings, keep the JSON reports.
What it does not replace is the runtime side. Give a skill the least access it needs, run it where it cannot reach your credentials or your whole filesystem, and watch what it does rather than what it looks like.
The honest takeaway
A large vendor shipping an open-source scanner for agent skills is a good signal: it means the supply-chain problem is being treated as real rather than theoretical. Use it, put it in CI, read its JSON.
Just do not let it become the only thing standing between an untrusted skill and your machine. The published evasion research is clear that install-time scanning is the layer attackers have already learned to walk past. For choosing tools you can reason about in the first place, our best coding LLMs 2026 overview is a starting point.
