An AI agent skill security scanner open source project from NVIDIA has quietly become one of the most-starred security tools of the agent era. SkillSpector scans the skills your coding agents install — the little instruction packs that tell Claude Code, Codex and other agents how to do a job — and flags prompt injection, data exfiltration, privilege escalation and supply-chain tricks before the skill ever runs. At the time of writing it carries more than 23,000 GitHub stars, close to 2,000 forks, and an Apache 2.0 licence, and it was updated as recently as 28 October 2026. If your team installs agent skills the way it used to install npm packages — quickly, on trust, and without reading them — this is the tool that closes that gap.
AI agent skill security scanner open source: what SkillSpector actually scans
An agent skill is, at its simplest, a folder with a SKILL.md file plus scripts, prompts and sometimes bundled tools. When an agent loads it, the skill’s instructions join the agent’s own instructions, and the agent may then read files, run commands, call APIs and write code with the permissions you gave it. That is a lot of trust to place in a folder somebody published on the internet — and most teams grant it without a second thought, because skills feel like documentation rather than code. SkillSpector’s premise is that they are code, and should be scanned like code.
The project comes out of NVIDIA’s Verified Skills pipeline, which scans, evaluates and signs skills before publication in NVIDIA’s skills catalogue. SkillSpector is the scanner at the front of that pipeline, released as open source so any team can run the same checks. It handles Claude Code, Codex CLI, Gemini CLI and MCP-based skills — breadth that matters, since teams rarely standardise on one agent tool.
The headline numbers in the project’s own documentation explain why NVIDIA built it. In a 31,132-skill subset of its research dataset, 26.1% of skills contained vulnerabilities and 5.2% showed likely malicious intent. Read that again: roughly one skill in four had a security problem, and roughly one in twenty looked deliberately hostile. Those figures come from the project’s README, not from an independent audit, but even if you discount them heavily, the direction is unmistakable. The skill ecosystem is growing faster than its vetting, and the install step is where the risk concentrates.
What it can do: 71 patterns across 17 risk categories
SkillSpector runs 71 vulnerability patterns grouped into 17 categories. The list reads like a tour of everything that can go wrong when an agent follows instructions it did not write:
- Prompt injection — instructions hidden in a skill that try to override the user’s or the system’s intent.
- Data exfiltration — skill code or prompts that quietly send files, keys or conversation content somewhere else.
- Privilege escalation — steps that push the agent beyond the access it was granted.
- Supply-chain risk — dodgy dependencies, fetched scripts and unpinned remote resources pulled in at install or run time.
- Excessive agency — skills that grant themselves broader tool access than the task needs.
- System prompt leakage and memory poisoning — attempts to extract the agent’s hidden instructions or to plant false facts in its memory for later sessions.
- Tool misuse, rogue-agent and anti-refusal patterns — skills designed to make the agent ignore safety refusals or misuse its tools.
- Trigger abuse and output handling — content that fires only on certain triggers, or that corrupts what the agent reports back.
- Dangerous code, taint tracking and YARA signatures — static analysis of bundled scripts, tracking of untrusted data through code, and signature matching for known-bad patterns.
- MCP least privilege and MCP tool poisoning — checks specific to Model Context Protocol servers: tools granted more scope than they need, and tool descriptions doctored to manipulate the agent.
Two features lift it above a simple grep for suspicious strings. First, one of its check families queries OSV.dev for live CVE data on dependencies, with an automatic offline fallback, so a skill bundling a known-vulnerable library is flagged with real vulnerability data rather than a guess. Second, analysis runs in two stages: fast static analysis first, with an optional LLM semantic evaluation on top. Static analysis catches the structural problems cheaply; the LLM stage is there for the subtle cases where intent matters — a prompt that looks innocent to a pattern matcher but reads as manipulation to a model. You can run static-only with a single flag, which is the right default for CI and for quick pre-install checks.
How it works: install, scan, and read the score
SkillSpector is written in Python and requires Python 3.12 or later. The fastest install uses uv, the modern Python package manager:
uv tool install git+https://github.com/NVIDIA/skillspector.git
From source, clone the repository and run make install in a virtual environment; a Docker image is also provided, and extensions exist for the Pi and OpenCode agent tools.
Scanning itself is one command, and the input can be almost anything a skill arrives as:
skillspector scan ./my-skill/ — scan a local skill directory; skillspector scan ./SKILL.md — scan a single file; skillspector scan https://github.com/user/my-skill — scan a Git repository; skillspector scan ./my-skill.zip — scan an archive. Add –no-llm for static-only analysis.
Every scan produces a risk score from 0 to 100 with severity labels and a recommendation, in terminal, JSON, Markdown or SARIF format. JSON and SARIF are the formats that matter for automation: JSON feeds your own tooling, and SARIF plugs straight into CI systems and IDE security panels that already consume that standard. Reports can also be compared over time, and a baseline mechanism lets you accept known findings — via a glob rule or a fingerprint baseline — so that re-scans surface only new issues instead of re-litigating the same accepted findings on every run. That single feature is what separates a scanner teams actually keep running from one they disable after a week of noisy repeats.
The tool is also deliberately fail-closed about resource abuse: remote downloads, zip extraction and cloned repositories are capped at 100 MiB per ingest, zip archives at 10,000 members, and individual files at 1 MiB of analysis, with oversized inputs rejected rather than partially scanned. Recursive scanning covers up to 32 skills by default, and batch scanning handles whole directories.
Why it is trending: skills are the new supply chain
SkillSpector’s rise is about timing. In the last year, agent skills went from a curiosity to the default way teams extend coding agents, via marketplaces, plugin directories and GitHub repositories. Every skill a developer installs is a new dependency — except that, unlike a software dependency, it is rarely pinned, rarely reviewed, and often installed with a single command copied from a README. The industry spent a decade learning to scan npm and PyPI dependencies; skills slipped in through a side door that had no scanner at all.
The MCP angle sharpens the point: tool poisoning — a tool description that looks helpful to a human but instructs the agent to do something else — is exactly the attack human code review misses, because the human reads the description while the agent reads the instruction. For businesses, the cost of one exfiltrated API key or one poisoned agent copying client data dwarfs the cost of a ten-second scan before install.
From our experience: where it earns its place, and where it stops
At MTD Technologies, nine years and more than 300 projects have taught us that teams keep only the tools that fit their existing workflow. SkillSpector passes that test: static-only scans are fast enough to run before every install, the baseline mechanism ends false-positive fatigue by surfacing only new findings, and SARIF output lets the scan live in CI beside existing linters rather than in yet another dashboard.
The honest limitations matter just as much. A scanner, even a good one, does not make a skill safe; it makes specific classes of unsafety visible. It will not tell you whether a skill’s advice is correct, whether its workflow fits your stack, or whether its author will maintain it next year. The LLM semantic stage adds judgement but also adds cost, latency and a new data-flow question: if you point it at a skill containing your own private prompts or credentials, that content may travel to a model provider, so run LLM analysis only on skills you are comfortable sharing, or self-host the model. Like every pattern-based tool, it can miss novel attacks and flag legitimate techniques, so the score is a triage aid, not a verdict.
Getting started: a five-step rollout for your team
- Install it once, centrally. Pick the uv install or the Docker image and document the one canonical command in your team wiki, so nobody installs a forked or outdated copy.
- Scan what you already have. Run a recursive static-only scan over every developer’s skill directory, collect the JSON reports, and triage as a team before changing anything.
- Set the baseline. Accept the findings you have reviewed and decided to live with, commit the baseline file, and make re-scans report only new findings.
- Gate new installs. Make a static scan part of the skill-install habit — a line in your onboarding doc and, where you can, a CI check on the repo that holds your shared skills.
- Reserve LLM analysis for the grey cases. Use the semantic stage when a static finding is ambiguous or a skill comes from an unfamiliar author, not on every routine scan, to keep cost and data exposure proportionate.
Teams that want help wiring this into their agent setup — shared skill repositories, CI gates, or a review process for third-party skills — can talk to us about AI integration and automation, or browse the AI Tools Directory for other agent tools we have reviewed. And if you are evaluating agent tooling for a client project, contact us before you standardise on a skill library nobody has audited.
Frequently asked questions
Is SkillSpector free to use?
Yes. It is open source under the Apache 2.0 licence, so you can use it commercially, modify it and redistribute it under that licence’s terms. The optional LLM semantic stage may incur model API costs depending on the provider you configure, but static-only scanning has no per-scan fee.
Which agent tools does SkillSpector support?
It is designed for skills used by Claude Code, Codex CLI, Gemini CLI and MCP-based setups, and it can scan local directories, single files, Git repositories, zip archives and URLs. Extensions also let you run it from inside Pi and OpenCode agent sessions.
Does a clean SkillSpector report mean a skill is safe?
No. A clean report means none of its 71 patterns matched and no known-vulnerable dependencies were found. It does not guarantee the skill’s advice is correct, its author is trustworthy, or that a novel attack is absent. Treat the score as triage, and keep human review for skills that will touch production data or credentials.
Should we run the LLM analysis stage or static-only?
Start static-only: it is fast, free and sufficient for CI and pre-install gates. Add LLM analysis for ambiguous findings or unfamiliar authors, and be mindful that skill content may be sent to a model provider in that mode unless you self-host the model.
How is SkillSpector different from scanning dependencies with npm audit or similar tools?
Dependency scanners check code libraries for known vulnerabilities. SkillSpector checks a different artefact — agent skills, including their prompts and instructions — for prompt injection, tool poisoning, memory poisoning and other agent-specific attacks that a dependency scanner cannot see, while also querying live CVE data for bundled dependencies.
SkillSpector will not solve agent security on its own, but it closes the most neglected gap in most teams’ agent setup: the moment a skill is installed. Twenty-three thousand stars suggest a lot of teams have recognised that gap at the same time. Scan what you already have, baseline what you accept, and make the scan part of every install from here on — that is a small habit with an outsized payoff.