NVIDIA SkillSpector Scans AI Agent Skills for Risk

A Package Inspector for the Thing You Just Told Your Agent to Install

NVIDIA has released SkillSpector, a free open-source scanner that reads an AI agent skill and tells you whether installing it is a good idea. Point it at a directory, a zip file, a single SKILL.md, or a Git URL, and it returns findings, a 0-100 risk score, and recommendations. Help Net Security covered the release on August 3, 2026.

• 64 vulnerability patterns across 16 categories, covering prompt injection, data exfiltration, privilege escalation, memory poisoning, excessive agency, tool misuse, and MCP-specific risks
• Two-stage analysis — a static pass in seconds using AST walking, taint tracking, YARA rules and regex, then an optional LLM semantic pass reported at roughly 87% precision
• Outputs terminal, JSON, Markdown and SARIF, so results drop straight into a CI pipeline rather than living in someone's terminal history
• Free and open source on GitHub, targeting the skill formats used by tools including Claude Code, Codex CLI, and Gemini CLI

Why Agent Skills Are a Supply Chain Nobody Inventoried

A skill is a small bundle: Markdown instructions plus, usually, Python scripts. That sounds harmless until you notice what a skill runs with. It executes in the agent's context, which means it inherits the shell, the environment variables, the SSH directory, and whatever credentials the developer's machine happens to hold.

That is the same blast radius as a post-install script in a package manager — a threat model the software industry spent fifteen years learning to take seriously. Agent skills arrived with the convenience of that model and none of the accumulated caution. There is no lockfile convention, no signing norm, no established review culture, and installation is frequently a single line pasted from a README.

Research cited in the SkillSpector repository puts numbers on it: a scan of 42,447 skills across major marketplaces found 26.1% containing at least one vulnerability and 5.2% showing likely malicious intent. Whatever the precise methodology, the order of magnitude is the point — this is not a hypothetical exposure.

How Does the Two-Stage Scan Work?

The first pass is deterministic and fast. SkillSpector walks the abstract syntax tree of any Python in the bundle, flagging exec, eval and subprocess calls and dynamic imports; runs taint tracking to see whether untrusted input reaches dangerous sinks; applies YARA signatures for known malware, webshells and cryptominers; and pattern-matches for credential access, typosquatted dependencies, homoglyph tricks, command shadowing, and persistence via cron. It completes in seconds.

The second pass is optional and uses an LLM endpoint — defaulting to NVIDIA's own build.nvidia.com — to judge intent rather than shape. This is the part that separates a skill legitimately calling subprocess to run a build from one calling it to phone home, and NVIDIA reports it lifts precision to around 87%.

That architecture is the right shape. Static analysis alone on a format this permissive produces a wall of findings nobody reads; LLM analysis alone is slow, costly, and non-deterministic. Fast-and-noisy followed by slow-and-judgemental is how mature security tooling handles this trade-off, and it is encouraging to see it applied here rather than a single-model verdict.

Does a Risk Score Actually Help?

Only if you treat it as triage rather than a verdict — and this is where I'd temper enthusiasm.

A 0-100 score with severity labels is genuinely useful for ordering a review queue and for setting a CI gate. It is not useful as a green checkmark. A skill can score cleanly and still do something you would not sanction, because "acceptable" depends on what the skill is for and what the machine running it can reach. A deployment skill that touches credentials is doing its job; a Markdown formatter that touches credentials is not. No scanner knows which one it is looking at.

The SARIF output is the feature I'd point security teams to first. SARIF is the standard format CI systems and code-scanning dashboards already ingest, which means skill scanning can become a pipeline step alongside dependency and container scanning rather than a manual habit that decays. That is how this kind of checking survives contact with a busy team.

Readers who followed our AI security coverage of SkillDetonate's runtime auditing of agent skills will recognize the complementary halves: SkillSpector inspects before installation, runtime auditors watch behaviour after. Neither substitutes for the other.

What Should Teams Do With This Today?

Three concrete things, in order of effort.

Scan what you already have. Most teams running coding agents have accumulated skills without an inventory, and a first pass over the existing set is a one-command exercise that will surface whatever is already resident.

Add it to CI. Gate on the SARIF output at whatever severity threshold matches your risk appetite, so new skills are checked on the way in rather than audited later.

Write down who may install skills and on which machines. Tooling does not fix the underlying issue, which is that agent skills currently install with developer privileges by default. The scanner tells you what a bundle does; policy decides whether anyone should be running it on a laptop with production credentials.

Why NVIDIA Shipping This Matters

An open-source scanner from a vendor with no marketplace to defend is a useful thing to have in a young ecosystem. It arrives alongside broader industry work on shared defensive tooling, including the Open Secure AI Alliance's 40-plus member effort, and it addresses a gap that was going to be filled by an incident otherwise.

The agent skill ecosystem is roughly where npm was before anyone had thought hard about install scripts. Getting a free scanner into circulation now — while conventions are still forming — is considerably cheaper than retrofitting one later.

Sources: Help Net Security — August 3, 2026; NVIDIA/SkillSpector on GitHub — August 2026; Towards Data Science analysis — August 2026.