Scan Agent Skills for Security Risks with NVIDIA SkillSpector

Agent skills run with implicit trust. Claude Code, Codex CLI, and Gemini CLI execute skill scripts with minimal vetting — and a 2026 study of 42,447 skills found that 26.1% contain at least one vulnerability, with 5.2% showing likely malicious intent. NVIDIA SkillSpector answers one question before you install: is this skill safe?

Why SkillSpector Matters

SkillSpector is a security scanner built specifically for the agent skill format. It detects vulnerabilities, malicious patterns, and security risks across 68 patterns in 17 categories, including prompt injection, data exfiltration, privilege escalation, supply chain, and memory poisoning.

Two details make it worth running before every install:

• Skills with executable scripts are 2.12x more likely to be vulnerable.
• Static analysis alone catches most issues — an optional LLM stage adds semantic evaluation for the rest.

You can scan a Git repo, a URL, a zip file, a directory, or a single SKILL.md file. Output comes as terminal, JSON, Markdown, or SARIF reports, with a 0-100 risk score and a clear recommendation.

Installation

SkillSpector is a Python CLI installed with uv or pip. It is not available through the skills installer, so install it directly from GitHub.

uv tool install git+https://github.com/NVIDIA/skillspector.git

# Update later
uv tool update skillspector

If you plan to use the built-in MCP server later, install the MCP extra at the same time:

uv tool install 'skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git'

No uv? Use a virtual environment and pip:

git clone https://github.com/NVIDIA/skillspector.git
cd skillspector
python3 -m venv .venv && source .venv/bin/activate
make install

A Docker image is also available (make docker-build), which needs no local Python.

Real Workflow: Scan a Skill Before You Install It

You downloaded a skill and want to know what it does before it touches your ~/.claude/skills/ directory.

skillspector scan ./my-skill/

The terminal report shows the risk assessment up front, then each finding with location, confidence, and explanation:

SkillSpector Security Report  v2.0.0

Skill: suspicious-skill
Source: ./suspicious-skill/

        Risk Assessment
 Score           78/100
 Severity        HIGH
 Recommendation  DO NOT INSTALL

Issues (2)

  HIGH: Env Variable Harvesting (E2)
    Location: scripts/sync.py:23
    Confidence: 94%

  HIGH: External Transmission (E1)
    Location: scripts/sync.py:45
    Confidence: 89%

SkillSpector accepts four input kinds, so the scan matches how you received the skill:

# Scan a single SKILL.md file
skillspector scan ./SKILL.md

# Scan a Git repository directly
skillspector scan https://github.com/user/my-skill

# Scan a zip archive
skillspector scan ./my-skill.zip

Remote and archive inputs are capped (100 MiB per ingest, 10,000 zip members) so oversized downloads and zip bombs fail closed instead of flooding your disk.

Understand the Risk Score

The score is a weighted sum of findings, with executable scripts given a 1.3x multiplier:

The final band maps directly to an action:

Scores at or below 50 exit with code 0. Scores above 50 exit with code 1, which makes the tool usable as a gate in scripts and CI.

Real Workflow: Add LLM Analysis for Semantic Findings

Static analysis catches known patterns. The LLM stage catches things patterns miss — like a prompt that tries to override the agent's instructions at runtime.

Configure a provider with environment variables, then run the same scan command:

export SKILLSPECTOR_PROVIDER=anthropic
export ANTHROPIC_API_KEY=sk-ant-...

skillspector scan ./my-skill/

Supported providers include OpenAI, Anthropic, AWS Bedrock, NVIDIA build, and local servers (Ollama, vLLM). You can also use your existing local Claude or Codex CLI session — no API key needed:

export SKILLSPECTOR_PROVIDER=claude_cli  # uses your claude auth login session
skillspector scan ./my-skill/

Skip the LLM stage when you want fast, offline static analysis only:

skillspector scan ./my-skill/ --no-llm

Real Workflow: Gate Installations in CI

You maintain a skill collection and want to block unsafe additions automatically. SkillSpector's exit code is a stable contract, so it slots into any pipeline:

Use JSON output for machine-readable results:

skillspector scan ./my-skill/ --format json --output report.json

The report includes risk_assessment.score, severity, and recommendation at the top level, so CI can map the recommendation to a policy:

For IDE and CI tooling that speaks SARIF, request that format instead:

skillspector scan ./my-skill/ --format sarif --output report.sarif

Suppress Known Findings with a Baseline

Once a skill passes review, you do not want the same accepted findings surfacing on every rescan. Generate a baseline once, commit it, then scan against it:

# Accept all current findings into a baseline (run once), then commit it
skillspector baseline ./my-skill/ -o .skillspector-baseline.yaml

# Only NEW findings are reported and scored
skillspector scan ./my-skill/ --baseline .skillspector-baseline.yaml

Review what was suppressed at any time with --show-suppressed. Baselines can use exact fingerprints or drift-tolerant glob rules, so changing the scanned source keeps a finding active until you review it again.

Tips

• Scan before you install, every time. A 30-second static scan is cheap insurance against a skill that exfiltrates environment variables.
• Run --no-llm for quick triage. Static analysis is fast and offline. Add the LLM stage only when you need semantic judgment.
• Check for executable scripts first. Findings in *.py, *.sh, or *.js files matter more — executable skills are 2.12x more likely to be vulnerable.
• Use SARIF output in editors. Many IDE tools and CI systems understand SARIF natively, which turns findings into inline annotations.
• Keep the baseline committed. Store .skillspector-baseline.yaml in your skill repo so every reviewer sees the same accepted-findings set.

When Not to Use SkillSpector

Skip it when you fully control the skill source and its author, or when the skill is a single prompt with no scripts. It is static analysis only: it cannot analyze text inside images, encrypted or compiled code, or dynamic runtime behavior, and non-English content may be missed.

Scan every skill before install. Find more security and developer-tools skills on the SkillMap leaderboard, and see NVIDIA's SkillSpector debut in this week's digest.