SkillSpector: NVIDIA Wants to Scan Your Skills Before You Install Them
Over the past few months, we’ve started installing Skills with the same ease that we used to install npm packages years ago.
One command.
One repository.
Five seconds later, they’re already part of our agent.
The problem is that a Skill isn’t just a Markdown file.
It can contain:
-
instructions for the agent,
-
scripts,
-
filesystem access,
-
tool calls,
-
command execution,
-
complete workflows.
In other words:
a Skill executes with the same level of trust we give to the agent.
And that’s when a question appears that almost nobody asks themselves.
Did you scan that Skill before installing it?
NVIDIA thinks we should start doing that.
That’s why they released SkillSpector, an open source scanner specifically designed to analyze agent Skills before they reach your machine.
Why does it exist?
The README starts with a rather uncomfortable fact.
Recent research on over 42,000 published Skills found that:
-
26.1% contained at least one vulnerability.
-
5.2% showed signs of malicious behavior.
That completely changes the conversation.
Until now we’ve been talking about:
-
prompt injection,
-
MCP Servers,
-
gateways,
-
sandboxes.
Now a new attack surface appears.
The Skills themselves.
What does SkillSpector do?
Think of it as a Dependabot or Trivy…
…but for agent Skills.
Instead of asking you:
“Does this package have a CVE?”
it helps you answer:
“Is it safe to install this Skill?”
It can analyze:
-
Git repositories,
-
URLs,
-
ZIP files,
-
local directories,
-
individual files.
What types of risks does it detect?
SkillSpector covers 64 vulnerability patterns grouped into 16 categories.
Among them:
-
Prompt Injection
-
Data Exfiltration
-
Privilege Escalation
-
Supply Chain Attacks
-
Memory Poisoning
-
Rogue Agent Behavior
-
Tool Misuse
-
MCP Tool Poisoning
-
Trigger Abuse
-
Dangerous Code Patterns
-
System Prompt Leakage
In other words, it doesn’t just look for traditional malware.
It also understands threats specific to the agent ecosystem.
Two-stage analysis
One of the most interesting aspects of the project is that it doesn’t rely solely on regular expressions.
The analysis happens in two phases.
1. Static analysis
Quickly searches for:
-
suspicious scripts,
-
vulnerable dependencies,
-
use of
exec, -
eval, -
dangerous calls,
-
known patterns.
Very fast.
Very cheap.
2. Semantic analysis (optional)
When a static rule isn’t enough, SkillSpector can use an LLM to answer questions like:
-
Does the behavior match the Skill’s description?
-
Is it trying to do more than it promises?
-
Are the instructions hiding unexpected actions?
This helps reduce false positives.
Installation
SkillSpector can be installed directly from PyPI.
pip install skillspector
Or run without installation using uv:
uvx skillspector scan <skill-path>
It also supports Docker for those who prefer to completely isolate the analysis process. The official documentation includes examples for all execution modes.
Scanning a Skill
For example:
skillspector scan https://github.com/user/my-skill
Or on a local directory:
skillspector scan ./skills/database-helper
It can also analyze a ZIP downloaded from a marketplace.
Integration with GitHub Actions
One of the most interesting use cases is incorporating it into your CI pipeline.
Before accepting a Pull Request that adds or modifies a Skill, the pipeline can automatically run SkillSpector.
If it detects important risks…
the merge simply doesn’t happen.
Complete examples already exist for integrating it with GitHub Actions.
Use case #1 — Before installing a Skill
You found an interesting Skill for Claude Code.
Before:
GitHub
↓
Install
Now:
GitHub
↓
SkillSpector
↓
Install
Five extra seconds.
Much more peace of mind.
Use case #2 — Private marketplace
If your company maintains internal Skills, you can automatically analyze them before publishing them to the rest of the team.
That way the internal marketplace incorporates a first layer of quality control.
Use case #3 — Periodic audits
Skills evolve too.
A good practice can be to re-scan them when the following change:
-
dependencies,
-
scripts,
-
permissions,
-
tools.
Not just when they’re first installed.
Why does this matter?
I think SkillSpector points to something much bigger than the project itself.
For years, security has focused on:
-
npm packages,
-
Docker images,
-
dependencies,
-
containers.
Now a new category appears:
artifacts for agents.
Skills.
MCP Servers.
Prompts.
Memories.
Plugins.
They’re all starting to become part of the software supply chain.
And, as happened before with npm or Docker Hub, they’ll probably need their own security tools.
The trend
Just a few months ago we were writing about:
-
CodeGate,
-
MCP Gateways,
-
Hooks,
-
execution policies,
-
sandboxes.
SkillSpector fits perfectly into that evolution.
It’s no longer enough to ask ourselves:
“What can my agent do?”
We also need to start asking:
“What am I allowing it to install?”
Because a Skill isn’t just a helper for the agent.
It’s code, instructions, and behavior that will execute with the trust you grant it.
And, as we learned years ago with npm, trusting by default rarely turns out to be a good strategy.
Resources
Official repository
Documentation