Image: NVIDIA
Why it mattersAn agent skill runs with the same trust the agent itself has. A scan before install is the only check standing between the reader and a malicious skill file.
An agent skill is a folder with a prompt file and a few scripts. It tells a coding agent, like Claude Code or Codex, how to perform a task. The skill runs with the same trust the agent has. If the skill tells the agent to read your SSH keys, the agent reads your SSH keys.
NVIDIA released SkillSpector as an open-source tool for scanning those skills before you install them. The repository sits on 22,262 stars at the time of writing and is ranked 20th on Trendshift's daily trending list. The project was created on 21 March 2026 and had its last commit on 23 October. It is Apache 2.0 licensed.
What the scanner looks for
The README says SkillSpector carries 71 vulnerability patterns across 17 categories. The named categories include prompt injection, data exfiltration, privilege escalation and supply-chain risks. They also include excessive agency, output handling, system prompt leakage and memory poisoning. Tool misuse, rogue-agent patterns, anti-refusal and trigger abuse are each their own category. Dangerous code is caught by abstract syntax tree scanning and taint tracking. YARA signatures cover known bad patterns, and two checks look at MCP tool rights.
Two stages run against each skill. Static analysis is fast and runs on every file. An optional semantic pass sends the skill through a language model for a deeper read. A separate step queries OSV.dev for known CVEs in any pinned dependencies, with an offline fallback for air-gapped use.
The numbers NVIDIA attaches to the problem
NVIDIA's own README gives the research finding behind the project. The company looked at a subset of 31,132 agent skills. It says 26.1 percent of them contain a vulnerability. It says 5.2 percent show likely malicious intent. These are NVIDIA's own figures from its own dataset. No third party has repeated them. SkillSpector is also part of a larger NVIDIA Verified Skills pipeline. That pipeline scans, grades and signs skills before they reach a public catalog.
What a developer does with it
SkillSpector reads a Git repository, a URL, a zip file, a directory or a single SKILL.md file. It writes a report in one of four formats: terminal output, JSON, Markdown or SARIF. The SARIF file is the one a CI system reads. A team can then refuse to merge a change that adds a flagged skill.
The project also packages itself as a Pi tool and an OpenCode tool. An agent can scan a skill from inside its own session, before it accepts the install. A per-ingest size cap of 100 MiB and a 10,000-entry zip limit both fail closed. That stops a hostile zip from running the scanner out of memory.
Source
- Primary source: NVIDIA/SkillSpector on GitHub.
- Related: NVIDIA Verified Skills documentation.
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
