SkillSpector for pre-installation security scanning of AI agent skills

NVIDIA's SkillSpector statically and semantically analyzes AI agent skill packages for prompt injection, exfiltration, and supply-chain risks before authorized installation in professional environments.

Tool	NVIDIA/SkillSpector — Python security scanner that vets AI agent skills before installation
Category	Static analysis and supply-chain security scanner for AI agent skill packages
Primary Use	Scanning SKILL.md files, skill directories, Git repos, zips, and URLs for prompt-injection, data-exfiltration, MCP-tool-poisoning, and other malicious patterns before installing them into agent runtimes like Claude Code or Codex CLI
Safe Use	Defensive vetting of third-party skills during authorized enterprise deployment, security research, and CI/CD supply-chain gating; the tool analyzes code you are evaluating, not attacking
Telemetry Note	Purely defensive: SkillSpector reads local or fetched artifacts and emits SARIF/JSON/Markdown reports; LLM-mode sends skill content to a configured provider endpoint, which defenders should treat as a data egress consideration

SkillSpector is NVIDIA's answer to a problem the agent ecosystem created faster than it could secure: skill packages for runtimes like Claude Code, Codex CLI, and Gemini CLI are installed with implicit trust and almost no vetting. The README cites an analyzed research dataset of 31,132 skills in which 26.1% contained vulnerabilities and 5.2% showed likely malicious intent — numbers that reframe agent skills as a genuine supply-chain surface rather than a convenience feature. The tool's single organizing question, stated plainly in the README, is whether a given skill is safe to install before it ever reaches an agent runtime. It is part of the NVIDIA Verified Skills pipeline, which scans, evaluates, and signs skills before publication to the NVIDIA skills catalog, so it is production infrastructure rather than a research prototype.

The core engine is a Python 3.12+ codebase under Apache-2.0, and its detection surface is unusually broad for the niche: 71 vulnerability patterns spread across 17 categories. The categories read like a taxonomy of everything that can go wrong in an agent skill — prompt-injection, data-exfiltration, privilege-escalation, supply-chain, excessive-agency, output-handling, system-prompt-leakage, memory-poisoning, tool-misuse, rogue-agent, anti-refusal, trigger-abuse, dangerous code detection via AST, taint tracking, YARA signatures, MCP least-privilege analysis, and MCP tool poisoning. What stands out is the pairing of AST-based dangerous-code analysis with behavioral categories like memory-poisoning and trigger-abuse — the latter only make sense once you accept that a skill's prose (SKILL.md) is itself executable instruction surface, not documentation.

Analysis runs in two stages. The first is fast static analysis — pattern matching, AST walks, taint tracking, and YARA rules — which works fully offline with the --no-llm flag. The second stage is optional LLM semantic evaluation, where a configured model reasons about the skill's intent and catches obfuscated instructions that signature rules miss. Input handling is deliberately flexible: skillspector scan accepts a local directory, a single SKILL.md, a Git repo URL, a zip archive, or an arbitrary URL, which maps well onto how skills actually circulate — as repos, marketplace archives, and pasted files.

The engineering discipline shows most clearly in the resource bounds, documented in ANALYSIS_RESOURCE_BOUNDS.md. Ingest is capped at INGEST_MAX_BYTES (100 MiB) across streamed URL downloads, uncompressed zip totals, and post-clone Git disk usage, plus a INGEST_MAX_ZIP_MEMBERS cap of 10,000 entries to blunt zip bombs. A downstream per-file MAX_FILE_BYTES limit of 1 MB bounds what individual analyzers read. Critically, a breach of either ingest cap fails closed with an IngestLimitExceededError — the tool refuses to guess rather than partially analyzing a hostile artifact. For a scanner whose own input is untrusted, fail-closed semantics are the correct default.

Live vulnerability lookups are handled by the SC4 analyzer, which queries OSV.dev for real-time CVE data with automatic offline fallback — so known-vulnerable dependency versions in a skill's requirements still get flagged when the network is available, and the scan degrades gracefully when it isn't. Results land in a 0-100 risk score with severity labels and recommendations, and output is emitted in four formats: terminal, JSON, Markdown, and SARIF. The SARIF path is the one that matters operationally, because it plugs directly into CI/CD gating and IDE tooling — the natural place for skill vetting in an enterprise is the same pipeline stage as dependency scanning.

The false-positive problem, which kills most pattern-based scanners in practice, gets a first-class answer in the baseline system. skillspector baseline accepts all current findings into .skillspector-baseline.yaml, after which skillspector scan --baseline reports and scores only new findings. Baselines can be exact fingerprints or drift-tolerant glob rules keyed on rule id, file path, or message. Two design details deserve note: fingerprint baselines are evidence-bound, so changing the source or the SkillSpector version reactivates findings until they're re-triaged, and a baseline stored inside the skill directory is itself excluded from content analysis so its suppression text can't be weaponized into findings or fingerprints. That second detail is exactly the kind of injection-resistant thinking you want from a tool whose input is adversarial.

The LLM stage is provider-agnostic through SKILLSPECTOR_PROVIDER, supporting openai, anthropic, bedrock via SigV4/boto3, Azure OpenAI, Vertex-style proxies, NVIDIA's own build.nvidia.com endpoint, generic OpenAI-compatible servers, and — more interesting — local CLI providers (claude_cli, codex_cli, gemini_cli) that reuse the local agent binary's own authentication. Local inference via Ollama or vLLM is supported for shops that don't want skill content leaving the perimeter. This matters from a defensive standpoint: in LLM mode, the scanner transmits skill content to a third-party endpoint, so the provider choice is itself a data-governance decision when scanning proprietary skills.

Installation is straightforward with uv: uv tool install git+https://github.com/NVIDIA/skillspector.git, with an [mcp] extra enabling the skillspector mcp subcommand, which exposes the scanner as an MCP tool for scanning skills from inside an agent session. A Docker path based on python:3.12-slim-bookworm lets you run static scans without a local Python: docker run --rm -v "$PWD:/scan" skillspector scan ./my-skill/ --no-llm. Batch scanning lives in contrib/batch_scan/, with parallel workers, multilingual detection (zh/ja/ko), and multi-key API pools for throughput — the README is honest that the default DeepSeek backend has structured-output gaps and invites better local-model backends, which is a refreshing admission of the tool's current rough edges.

There's also a Pi extension documented in PI_EXTENSION.md for in-session scanning, reinforcing the intended workflow: vet before install, not after. The README's open-source notice about downloading third-party dependencies at install time is another small but correct disclosure — a supply-chain scanner should be transparent about its own supply chain, and the project carries an OpenSSF Scorecard badge and HVTrust badge pointing to third-party attestation.

For defenders, SkillSpector is best positioned as the gate in front of skill installation — the point where agent ecosystems are currently weakest. Run it in CI with SARIF output and a committed baseline, keep LLM evaluation on a local or approved endpoint, and treat every third-party skill as hostile input until its report says otherwise. The 5.2% malicious-intent figure in the README is the argument; the tool is the control.

Official project repository for NVIDIA/SkillSpector.

Download Tool

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.