SkillSpector: NVIDIA’s open-source security scanner for AI agent skills

SkillSpector is an open-source scanner from NVIDIA that reads an agent skill and tells you whether to install it. Point it at a directory, a zip file, a single SKILL.md, or a Git URL, and it returns a list of findings, a risk score, and recommendations.

The folder it reads runs with everything you have. A skill is Markdown instructing the agent, sometimes with a Python script beside it that reaches the shell, the environment variables, and the SSH directory. The script is where risk concentrates. The study behind the tool found skills that ship one are 2.12x more likely to be vulnerable. Agents load them on trust.

How it reads a skill

The first pass is static and takes seconds. An AST walk flags exec, eval, subprocess, and dynamic imports. A taint tracker follows environment variables and file contents to network sinks. YARA rules match known malware, webshells, and cryptominers.

Regex analyzers handle the rest of the 64 detection patterns, covering prompt injection, credential access, memory poisoning, typosquatted dependencies, and cron-job persistence.

Some patterns exist only because a skill is a prompt. One flags a trigger that shadows a built-in command, so the agent reaches for the skill when the user typed something ordinary. Another flags homoglyphs and right-to-left overrides in tool metadata. A third flags zero-width characters and HTML comments carrying directives a human reviewer scrolls right past.

Dependency checking goes out to the network. SkillSpector batches a skill’s package list into one query to OSV.dev, gets back known CVEs, and caches the answer for an hour. An air-gapped run falls back to a small built-in list.

A second pass is optional, slower, and off until you configure it: it needs an OpenAI-compatible endpoint and a key, set through SKILLSPECTOR_PROVIDER, defaulting to NVIDIA’s own build.nvidia.com. Wired up, an LLM reads the flagged code in context, drops false positives, and writes an explanation someone can act on, which the project puts at roughly 87% precision. The prompt carries anti-jailbreak instructions, because the thing under analysis is itself a set of instructions to a model.

How the score comes out

Each finding adds points. A critical finding costs the most, a low one costs least, and anything past 50 on the scale comes back as do not install.

Executable content multiplies the result by 1.3. A pair of high-severity findings in a skill that ships a Python script crosses the do-not-install line on its own.

What you do with the output

Terminal output gives a human the score, the file list, and each finding with a line number and a confidence figure. The same scan writes JSON for scripting, Markdown for a review thread, and SARIF for CI, which puts findings in the same place as the rest of a pipeline’s security results.

The --no-llm flag drops the second pass. Scans finish faster with more false positives to sort through, but they still reach the network, because the OSV.dev lookup lives in the static pass. Offline is a separate condition, and it costs you the live CVE data.

SkillSpector is available for free on GitHub.

Must read:

• 20 open-source cybersecurity tools to keep your team ready for anything
• GitHub CISO on security strategy and collaborating with the open-source community

Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!