NVIDIA Releases SkillSpector Security Scanner for AI Agent Skills

Overview of SkillSpector

NVIDIA has introduced SkillSpector, an open-source security scanner designed to evaluate AI agent skills used by platforms such as Claude Code, Codex CLI, and Gemini CLI before installation. According to the project's documentation, agent skills often execute with implicit trust and minimal vetting. Research cited in the project notes that within a sampled dataset of 31,132 analyzed skills, 26.1% contained vulnerabilities and 5.2% displayed indicators of likely malicious intent.

SkillSpector is integrated into the NVIDIA Verified Skills pipeline, which scans, evaluates, and signs agent skills before they are published to the official NVIDIA catalog.

Detection Capabilities and Analysis Pipeline

The utility employs a two-stage analysis pipeline to identify potential security risks:

• Stage 1: Fast Static Analysis: Combines regex pattern matching across 11 static analyzers, Abstract Syntax Tree (AST) behavioral checks for dangerous functions, YARA signatures, and live vulnerability lookups against OSV.dev for known CVEs in dependencies.
• Stage 2: Optional LLM Semantic Evaluation: Utilizes configurable AI models to perform deeper semantic reviews. Deterministic static findings remain in the report regardless of LLM output, and models cannot lower deterministic finding scores. Disputed or unaddressed items are tagged as `llm-unconfirmed`.

In total, the tool reports tracking 71 vulnerability patterns spanning 17 categories, including prompt injection, data exfiltration, privilege escalation, supply chain risks, excessive agency, system prompt leakage, and Model Context Protocol (MCP) tool poisoning.

Usage and Integration

SkillSpector can be deployed across multiple workflows:

• Command Line Interface: Scans local directories, Git repositories, URLs, ZIP files, or single files, outputting results in terminal, JSON, Markdown, or SARIF formats.
• MCP Server Mode: Runs as a Model Context Protocol server, enabling local CLI agents to invoke scanning dynamically and gate installations based on safety verdicts.
• Docker Container: Offers a containerized deployment path based on Python 3.12-slim-bookworm.

Risk assessment scoring ranges from 0 to 100, mapping severity labels (`LOW`, `MEDIUM`, `HIGH`, `CRITICAL`) to recommended actions categorized as `SAFE`, `CAUTION`, or `DO_NOT_INSTALL`.

Verification and Limitations

Users and administrators looking to verify the original announcement and review documentation can inspect the official NVIDIA/SkillSpector GitHub Repository.

Practical implementation considerations include:

• Ingest Limits: To mitigate oversized downloads and archive bombs, the tool enforces a default per-ingest cap of 100 MiB (`INGEST_MAX_BYTES`) and a maximum zip member cap of 10,000 entries (`INGEST_MAX_ZIP_MEMBERS`).
• Network and Authentication: HTTP server bindings are restricted to loopback addresses by default and lack built-in authentication, requiring a reverse proxy such as Nginx with mTLS for remote access.
• Open-Source Notice: The project may download and install additional third-party open-source components, requiring users to review applicable licenses.