NVIDIA's SkillSpector: an open-source security scanner for AI agent skills

What this is about

SkillSpector is a security scanner from NVIDIA for agent skills. These are add-on packages (usually a SKILL.md with instructions and sometimes scripts) that give AI coding agents like Claude Code, Codex CLI or Gemini CLI new abilities. According to the README, such skills run on "implicit trust" with little vetting. The tool is meant to answer one question: "Is this skill safe to install?" It's open source (Apache-2.0, Python 3.12+) on GitHub, where it's currently trending.

NVIDIA backs up the motivation with numbers. In an analyzed subset of 31,132 skills from a research dataset, 26.1% contained vulnerabilities and 5.2% showed likely malicious intent. SkillSpector is part of the "NVIDIA Verified Skills" pipeline, in which skills are scanned, scored and signed before they appear in NVIDIA's skills catalog.

What the scanner checks

SkillSpector knows 71 vulnerability patterns in 17 categories. These include:

• Prompt injection: hidden or overriding instructions, such as commands to ignore safety rules, instructions in comments or invisible text, or whitespace padding that hides text.
• Anti-refusal: jailbreak phrasing like "never refuse" or "no restrictions".
• Data exfiltration: sending data to external URLs, harvesting environment variables, searching directories for sensitive files.
• Privilege escalation: for example sudo/root calls or reading SSH keys and tokens.
• Supply chain: unpinned dependencies, curl | bash, obfuscated code, known vulnerabilities (live via OSV.dev with an offline fallback), typosquatting, bundled Python bytecode, hidden executables.
• Others: excessive agency, insecure output handling, system prompt leaks, memory manipulation, tool misuse, taint tracking, YARA signatures, and MCP least privilege and MCP tool poisoning.

Each pattern has a severity (LOW to CRITICAL). The result is a risk score from 0 to 100 with a recommendation. Analysis runs in two stages: first fast static analysis (code is only read, not executed), then an optional semantic evaluation by an LLM.

Usage

Install with uv tool install git+https://github.com/NVIDIA/skillspector.git, from source, or via Docker (no local Python needed). You can scan local folders, individual SKILL.md files, Git repos, URLs and zip files: skillspector scan ./my-skill/. With --no-llm, only static analysis runs. Reports come as terminal output, JSON, Markdown or SARIF (the standard format for CI/CD and IDE tools).

Other features:

• Baseline: You can suppress known, accepted findings so re-scans show only new problems.
• Scope exclusions: --exclude skips files. Coverage then counts as partial and there's no "SAFE" recommendation. --fail-on-incomplete makes CI fail in that case.
• Batch scan: Many skills in parallel, including multilingual detection (zh/ja/ko).
• MCP comparison: You can compare snapshots of MCP registries.
• Limits: 100 MiB per download/archive, at most 10,000 zip entries, 1 MB per analyzed file. These guard against zip bombs, and exceeding them aborts the scan.

LLM providers and MCP server

The LLM stage supports many providers: OpenAI, Anthropic, Bedrock, Gemini, Azure OpenAI, NVIDIA Build, any OpenAI-compatible endpoint, plus local Ollama (default llama3.1:8b) and CLI providers like claude_cli. The codex_cli provider is disabled because its sandbox can read host files. The README also notes that the batch scanner was tested with DeepSeek and that the author has no hardware to test local models. Contributions toward a more universal backend are welcome.

With skillspector mcp (extra skillspector[mcp]), SkillSpector runs as an MCP server (Model Context Protocol, the standard for connecting tools to agents). It offers a scan_skill tool that returns risk score, severity, recommendation and safe_to_install, so an agent can vet installations itself. To register it in Claude Code: claude mcp add skillspector -- skillspector mcp. HTTP mode has no authentication, binds only to loopback addresses and rejects local paths. For remote access, NVIDIA recommends an authenticating reverse proxy. For stdio mode, a known hang during initialization is noted (issue #199).

Our take

Skills and MCP servers open up a new attack surface. Text instructions that an agent follows are hard to tell apart from harmless ones. A freely usable scanner that also supports CI formats like SARIF is useful for teams that use third-party skills. But there are limits. The prevalence figures (26.1% and 5.2%) come from NVIDIA's README, and the underlying study isn't described there. Rule-based and LLM-assisted checks tend to produce false alarms and can miss new threats. The baseline feature shows that false positives are expected. A low score after a static scan is no proof of safety, which is why the MCP server also reports llm_used and scan_mode. If you use skills, treat the scanner as an extra hurdle, not a replacement for your own review. The README also warns that the project installs additional third-party software.