NVIDIA SkillSpector

Overview

NVIDIA SkillSpector is an open-source security scanner for AI agent skills. It is designed to answer a practical question before installing a skill: does this bundle contain risky instructions, scripts, dependencies, permissions, or MCP metadata that deserve review?

Use it as a pre-install or CI triage tool for Claude Code, Codex CLI, Gemini CLI, Cursor, and other Agent Skills-style ecosystems. It accepts Git repositories, URLs, zip files, directories, and single files, then produces risk-scored terminal, JSON, Markdown, or SARIF reports.

Install

The README documents source-based installation in an activated virtual environment:

git clone https://github.com/NVIDIA/SkillSpector.git
cd SkillSpector
uv venv .venv
source .venv/bin/activate
make install

Run a static-only scan without sending content to an LLM provider:

skillspector scan ./my-skill/ --no-llm

Generate machine-readable output:

skillspector scan ./my-skill/ --no-llm --format json --output report.json
skillspector scan ./my-skill/ --no-llm --format sarif --output report.sarif

The README also documents Docker builds and optional LLM analysis through OpenAI, Anthropic, NVIDIA build, or OpenAI-compatible local endpoints.

Capabilities

Use Cases

• Scan a third-party Agent Skill before installing it into Claude Code, Codex, Gemini CLI, Cursor, or a similar agent runtime.
• Add a static-only --no-llm check to a skill registry review workflow.
• Generate SARIF for CI, code scanning, or security-review artifacts.
• Review MCP-enabled skills for underdeclared capabilities, wildcard permissions, missing permissions, overdeclared permissions, hidden tool instructions, Unicode deception, parameter injection, and description-behavior mismatches.
• Triage suspected malicious skills that ask for broad shell, file, network, environment, memory, or MCP tool access.

Source Review

Verified on 2026-06-18:

• The upstream README describes SkillSpector as a security scanner for AI agent skills used by Claude Code, Codex CLI, Gemini CLI, and similar tools.
• The README states that SkillSpector scans Git repos, URLs, zip files, directories, and single files.
• The README lists 64 vulnerability patterns across 16 categories, including prompt injection, data exfiltration, privilege escalation, supply-chain risk, excessive agency, output handling, memory poisoning, tool misuse, rogue agent, trigger abuse, YARA signatures, MCP least privilege, and MCP tool poisoning.
• The README documents fast static analysis plus optional LLM semantic evaluation.
• The README documents terminal, JSON, Markdown, and SARIF output, with risk scoring and recommendations.
• pyproject.toml declares the skillspector CLI, Python 3.12+ support, Apache-2.0 licensing, LangGraph, OpenAI, Anthropic, NVIDIA, YARA, and security-scanner dependencies.
• src/skillspector/cli.py exposes skillspector scan, --no-llm, --format, --output, and --yara-rules-dir options and exits nonzero for high-risk scan results.
• src/skillspector/input_handler.py resolves Git URLs, raw file URLs, local zip files, single Markdown files, and directories into a local scan path.
• docs/B.3.1-mcp-least-privilege.md documents implemented MCP least-privilege checks for underdeclared, wildcard, missing, and overdeclared permissions.
• docs/B.3.2-mcp-tool-poisoning.md documents implemented tool-poisoning checks for hidden instructions, Unicode deception, parameter injection, and description-behavior mismatch.
• docs/SC4-osv-live-vulnerability-lookups.md documents OSV.dev batch lookups, caching, fallback behavior, severity mapping, and validation tests.
• GitHub metadata reported the repository under NVIDIA/SkillSpector, Apache 2.0 licensing, Python as the primary language, active updates in June 2026, and no latest GitHub release at the time of review.
• PyPI did not resolve a public skillspector package at review time, so this entry uses the source install path from the README instead of a package URL.

Safety and Privacy

SkillSpector helps reduce skill-install risk, but it does not make untrusted skills safe to execute. Use it before installation, inspect the flagged files manually, and prefer disposable workspaces or containers when scanning unknown repositories, URLs, or zip archives.

Static-only scans avoid model-provider disclosure. If LLM analysis is enabled, skill content and findings can leave the local machine through the configured provider or endpoint. Treat reports as sensitive because they may include paths, source snippets, dependency names, vulnerability IDs, and details about private agent workflows.

Duplicate Check

Checked current content/tools/, content/skills/, content/mcp/, content/agents/, README entries, open pull requests, and repository-wide content for SkillSpector, NVIDIA SkillSpector, NVIDIA/SkillSpector, skillspector, agent skill scanner, malicious skill detection, MCP least privilege scanner, and MCP tool poisoning scanner. No dedicated SkillSpector entry, exact source URL duplicate, target file, or open duplicate PR was found.

Disclosure

Editorial listing. No paid placement or affiliate link is used. NVIDIA SkillSpector is Apache-2.0 open-source software; model providers, OSV.dev, LangGraph/LangChain tracing, Docker images, Git hosting, CI systems, SARIF viewers, and scanned skill sources may have separate terms, billing, retention, privacy controls, and operational requirements.