SkillSpector: Security Scanner for AI Agent Skills by NVIDIA

RepositoryNVIDIA/SkillSpectorTool

SkillSpector is an open-source security scanner from NVIDIA designed to inspect extensions and skills for AI agents (such as Claude Code, Codex CLI, and MCP) for vulnerabilities and malicious patterns before installation.

Key points

  1. Detects risks including prompt injection, data exfiltration, memory poisoning, MCP permission flaws, and supply-chain threats across 71 patterns in 17 categories.
  2. Employs a two-stage evaluation pipeline combining fast static analysis (AST, taint tracking, YARA rules) with optional semantic LLM evaluation.
  3. Includes live CVE lookups via OSV.dev with an automated offline fallback mode.
  4. Accepts diverse inputs (Git repositories, URLs, zip files, directories) and outputs reports in terminal, JSON, Markdown, and SARIF formats.
  5. Serves as the foundation for the NVIDIA Verified Skills pipeline, scanning and signing skills prior to catalog publication.

Why it matters

AI agents operate with substantial privileges across local environments, APIs, and proprietary code. With cited research indicating that 26.1% of agent skills contain vulnerabilities and 5.2% show malicious intent, automated pre-install scanning is essential for AI supply-chain integrity.

Analysis

SkillSpector targets security engineers, developers, and enterprises integrating third-party agent skills into development environments. Built on Python 3.12+, it combines established static security tooling (AST parsing, YARA, taint tracking) with modern agent-specific checks and SARIF export for CI/CD gating. Backed by NVIDIA's Verified Skills infrastructure and over 15,000 GitHub stars, the repository exhibits production-level maturity.

Mentioned links

Found in

Summary generated by AI (Gemini 3.8 Flash, 27 September 2026). It may contain errors – the original source is authoritative.

Related entries

Similar in content, found by the AI search.

  • Link:SkillPatch

    SkillPatch: Directory for Security-Verified AI Agent Skills

    SkillPatch is a public registry for AI agent skills based on the open SKILL.md standard. The platform provides automated security assessments prior to publication and supports tools such as Claude Code, Cursor, and GitHub Copilot.

    AI & LLMs· Tool

  • Repository:affaan-m/agentshield

    AgentShield: Security Auditor for Claude Code and MCP Configurations

    AgentShield is an open-source TypeScript security scanner designed for AI agent setups. It inspects `.claude/` directories to detect hardcoded secrets, unverified MCP servers, hook injection vulnerabilities, and tool permission misconfigurations.

    1.2kstarsTypeScript

    AI & LLMs· Tool

  • Repository:cloudflare/security-audit-skill

    Cloudflare Open-Sources Security Audit Skill for Coding Agents

    Cloudflare's security-audit-skill is an open-source coding-agent workflow that orchestrates multi-phase security audits with independently verified, machine-readable findings.

    5.2kstarsJavaScript

    AI & LLMs· Tool

  • Repository:nealbridges/VulnHunter

    VulnHunter: Agentic AI Security Scanner for Exploitable Vulnerabilities

    VulnHunter is an open-source, agentic AI security scanner that inspects source code from an attacker's perspective, confirms exploitability, and generates fixes. This maintained fork of Capital One's original project decouples the tool from Claude Code to support arbitrary agent harnesses and open-weight models.

    223starsPython

    AI & LLMs· Tool

Back to the knowledge base

Let's talk about your project

Get in touch

Locations

  • Mattersburg
    Johann Nepomuk Bergerstraße 7/2/14
    7210 Mattersburg, Austria
  • Vienna
    Ungargasse 64-66/3/404
    1030 Wien, Austria

Parts of this content were created with the assistance of AI.