NVIDIA SkillSpector is an open-source scanner that answers one question: is this agent skill safe to install? It reads a skill (a SKILL.md plus whatever scripts ship with it), matches it against 71 vulnerability patterns across 17 categories, optionally asks an LLM to judge intent, and returns a 0-100 risk score with a recommendation. The project README on GitHub frames the need with a statistic: in a 31,132-skill analyzed subset of its research dataset, 26.1% of skills contain vulnerabilities and 5.2% show likely malicious intent. This post explains how the tool works, how to run it, where its limits are, and how it fits next to a lightweight local scan such as beam scan.
It matters because skills execute with implicit trust. When you drop a skill into .claude/skills, the agent follows its instructions with your shell, your files and your network access. A scanner that catches the obvious problems before that moment is a useful control, and this is the most complete open-source one we have seen for the job.
| Question | Short answer |
|---|---|
| What is it? | NVIDIA's open-source CLI scanner for agent skills and MCP servers |
| Is this a vulnerability or incident? | No. It is a defensive tool, trending on GitHub this week |
| What does it scan? | Git repos, URLs, zip files, directories, single files |
| How does it analyze? | Static analysis first, optional LLM semantic review second |
| Does my skill leave my machine? | Not with --no-llm. With an LLM provider, content goes to that provider |
| Output formats? | Terminal, JSON, Markdown, SARIF |
| Is a clean score a guarantee? | No |
What SkillSpector checks
The README lists 17 categories: prompt injection, data exfiltration, privilege escalation, supply chain, excessive agency, output handling, system prompt leakage, memory poisoning, tool misuse, rogue agent, anti-refusal, trigger abuse, dangerous code found through AST analysis, taint tracking, YARA signatures, MCP least privilege and MCP tool poisoning. Together they cover 71 patterns at the time of writing. NVIDIA's scanning guide quotes a slightly lower count (68 patterns), and the README's own tables list more rows than its headline figure, so the number moves as the project ships; treat it as approximate.
Three of those categories map directly onto attacks we have written about. Prompt injection and hidden instructions are the mechanism behind poisoned skill files such as the malicious AGENTS.md hijack. MCP tool poisoning is the same idea applied to tool descriptions, as in Cursor MCP config poisoning. Supply-chain checks query OSV.dev for known vulnerable dependencies, with an offline fallback when the network is unavailable.
How the two-stage analysis works
Stage one is fast static analysis: pattern rules, AST inspection for dangerous code, taint tracking, and YARA signatures. It needs no model and no network beyond the optional OSV lookup. Stage two is an LLM semantic evaluation that you enable by configuring a provider. NVIDIA's scanning guide notes why the second stage matters: with --no-llm, checks that compare declared intent with actual behavior, such as a description that does not match what the code does, or vague triggers, may not run.
The README supports a long list of providers through SKILLSPECTOR_PROVIDER, including OpenAI, Anthropic, AWS Bedrock, Gemini on Google Cloud, NVIDIA's build endpoint, Azure OpenAI, any OpenAI-compatible server, and local Ollama. A codex_cli provider is listed as disabled because, in the README's words, its read-only sandbox permits host-file reads. That is a small but telling detail: even the scanner's authors avoid pointing an agent at untrusted content when that agent can read the host.
The report is a risk score from 0 to 100 plus severity labels and a recommendation. Reports can be exported as JSON, Markdown, or SARIF for CI and IDE tooling.
How to run it
The README's quick start uses uv:
uv tool install git+https://github.com/NVIDIA/skillspector.git
skillspector scan ./my-skill/ --no-llm
You can also scan a single file, a Git URL or a zip, and produce a machine-readable report:
skillspector scan ./SKILL.md
skillspector scan https://github.com/user/my-skill
skillspector scan ./my-skill/ --format sarif --output report.sarif
A Dockerfile is included for people who would rather not install Python tooling on their workstation, and the README gives a docker run --rm -v "$PWD:/scan" skillspector scan ./my-skill/ --no-llm recipe. For MCP, there is a --mcp-registry mode that scans registry payload captures and can compare two snapshots, listing added and removed server identities and changed fields. The README notes that this comparison never suppresses findings and does not contact the listed servers.
Because the install pulls code from a Git URL and downloads third-party open-source dependencies (the README says so in an open-source notice), run it in a virtual environment or container the first time and review the license terms, as you would for any new tool.
Handling false positives and partial scans
Two features show the authors have run this against real skills. A baseline file records accepted findings so later scans only report new ones; fingerprint baselines are evidence-bound, so changing the scanned source keeps a finding active until someone reviews it again. And explicit scope options let you exclude files, but any exclusion makes coverage partial and prevents a SAFE recommendation, with --fail-on-incomplete available to fail CI in that case.
The tool also enforces size limits: ingest is capped at 100 MiB and 10,000 zip members, and a breach fails closed. Those caps are there to blunt oversized downloads and zip bombs aimed at the scanner itself.
What NVIDIA recommends doing with a report
NVIDIA's scanning agent skills guide says to scan before installing, and gives triage rules by finding type: block critical or high-severity findings until fixed or formally accepted; remove hidden instructions and tool poisoning; update permissions or remove behavior when a skill uses more capability than it declares; upgrade or pin vulnerable dependencies; and rewrite descriptions that do not match behavior. The stated goal is a skill whose "declared purpose, permissions, code, and documented risks all agree." SkillSpector also runs as the security tier of NVIDIA's skill evaluation pipeline, and the README says it is part of the NVIDIA Verified Skills process that scans, evaluates and signs skills before publication. See also how NVIDIA's open agent safety platform approaches runtime controls.
What developers are saying
The Hacker News thread is small, but one comment captures the main objection. jacobgold wrote that the approach is useful for validating some skills but risks a false sense of security, comparing it to antivirus: skills are ultimately prompts, agents execute code based on them, and if the agent can run commands and reach the internet it is hard to prove trust. Their recommendation was not to run skills from any source you would not download and execute code from. That is the commenter's view, but it matches NVIDIA's own framing that scanning produces evidence for a decision.
What this means if you run AI coding agents
- Scan before you copy a skill into
.claude/skillsor an equivalent folder. Do it on the exact bytes you plan to install, not a README description of them. If a skill comes from a package dependency, see our write-up of vlt skills linking npm packages into agent directories. - Prefer
--no-llmfor untrusted content you would rather not send anywhere, and accept that intent-versus-behavior checks are weaker. If you enable an LLM provider, remember the skill text is sent to it. - Read the skill anyway. The scanner reduces the pile you have to read; it does not replace reading. Our agent skills specification and security review lists what to look for in a
SKILL.md. - Pin and re-scan. A skill that passed last month can change on update. Re-run the scan whenever the version changes and keep a baseline in version control.
- Limit what a skill can do after it passes. Scanning is a gate at install time; permissions, sandboxing and runtime monitoring cover what static analysis cannot see.
How Beam handles this
Beam covers the same pre-install step with a much smaller tool. beam scan SKILL.md runs offline on a local file with 11 heuristic patterns, and beam scan .mcp.json --mcp validates the JSON and checks version pinning. It needs no collector or account, does not follow referenced files, and does not contact servers named in the input. Findings carry severity and matched evidence for you to review. Beam's own docs say plainly that the scan is heuristic and is not semantic malware analysis.
Where SkillSpector is the deeper scanner (more patterns, optional LLM review, SARIF, registry diffing), Beam's advantage is the part after install: its Claude Code and Codex PreToolUse hooks can deny risky actions and it keeps events local, with secrets redacted before storage. Beam's deny is hook-based, not a kernel sandbox. Using both is reasonable: SkillSpector to decide what to install, Beam to watch what it does. See Beam's security skills and subagents and the /#watches section.
Limits to keep in mind
- Static patterns are bypassable. A determined author can phrase an instruction in ways no rule anticipates, and instructions fetched at runtime from a URL are invisible to a scan of the files on disk.
- Pattern counts and defaults change between releases. The docs and README disagree on totals (68 versus 71), and the README says newer models are opt-in as defaults until they pass live acceptance checks. Pin the SkillSpector version you use in CI.
- A score is not a verdict. The README itself describes partial-coverage handling precisely because an incomplete scan should not read as SAFE.
- We have not benchmarked its detection rates. Third-party pages quote precision figures we could not trace to NVIDIA, so we do not repeat them.
Frequently asked questions
What is NVIDIA SkillSpector?
SkillSpector is an open-source security scanner from NVIDIA for AI agent skills. It inspects skills used by Claude Code, Codex CLI, Gemini CLI and MCP setups for prompt injection, data exfiltration, privilege escalation and supply-chain risk before you install them.
Does SkillSpector send my skill to an LLM?
Only if you configure a provider. The first stage is static analysis, and you can force static-only scans with --no-llm. The optional second stage sends content to the model provider you choose, including a local Ollama server if you prefer.
Is a clean SkillSpector report proof a skill is safe?
No. A skill is instructions an agent follows, and no scanner can prove every instruction is harmless. A low score means fewer known patterns matched. Read the skill, check who published it, and limit what the agent can touch.
How do I run SkillSpector in CI?
Install it with uv, then run skillspector scan on the skill directory with --format sarif and an output file. The README documents SARIF for CI and code scanning, a baseline file for accepted findings, and --fail-on-incomplete for partial scans.
How is SkillSpector different from beam scan?
SkillSpector is broader, with 71 patterns, optional LLM review and several input types. beam scan is a small offline check with 11 heuristics and an MCP version-pin check on a local file. Beam also watches what the agent does afterwards.
Who is affected by malicious skills?
Anyone who installs third-party skills into Claude Code, Codex, Gemini CLI or similar agents. NVIDIA cites research in which 26.1% of 31,132 analyzed skills contained vulnerabilities and 5.2% showed likely malicious intent.
Related reading
- Agent skills specification and security review
- vlt 1.5.0 skills and npm dependencies
- MCP server security review
- Beam security skills and subagents
- NVIDIA open agent safety platform
- Zero Breach Toolkit: vetting a free spyware scanner before you run it
- Sources: SkillSpector repository, NVIDIA: scanning agent skills
Tool details, pattern counts and defaults are accurate as of October 26, 2026 and may change; check the repository for current behavior. Beam is a local prototype and its scan is heuristic.