SkillSpector – NVIDIA's Open-Source AI Agent Skill Security Scanner

1. What Is SkillSpector

SkillSpector is an open-source AI Agent skill security scanner from NVIDIA. Before installing skills on Claude Code, Codex CLI, Gemini CLI, and similar platforms, it automatically detects vulnerabilities, malicious patterns, and security risks. It accepts Git repos, URLs, archives, directories, and single files; ships 64 vulnerability patterns across 16 security categories; offers a two-stage pipeline of fast static scan plus optional LLM semantic evaluation; and outputs terminal, JSON, Markdown, and SARIF reports with 0–100 risk scores and remediation guidance. It fills a gap in Agent ecosystem skill security with a practical review workflow for developers, enterprises, and marketplaces.

Technical positioning and domain: AI security focused on Agent skills—not generic SAST. Optimized for Agent threat models: prompt injection, excessive agency, system prompt leakage, etc. Local lightweight CLI as first-line defense before skill install.

Development background: From NVIDIA's GPU and AI security experience. As Claude Code, Codex CLI, Gemini CLI spread, malicious skills risk data exfiltration and system compromise. SkillSpector standardizes pre-install security checks for the community.

Core value: Pre-install skill review that generic scanners miss. Sixty-four patterns and two-stage analysis catch prompt injection, exfiltration, supply-chain poisoning, etc. 0–100 scoring aids decisions; CI/CD-native SARIF shifts security left.

Technical characteristics: Stage 1: regex + AST static scan for high recall; stage 2 optional LLM semantic eval (~87% precision). Real-time OSV.dev CVE lookup without API keys and offline fallback.

2. Key Features

• Multi-format input: Git, URL, zip, directory, single file—scan without preprocessing.

• 64 patterns / 16 categories: Prompt injection, exfiltration, privilege escalation, supply-chain poisoning, excessive agency, output handling, system prompt leak, memory poisoning, tool abuse, rogue agents, trigger abuse, dangerous code AST, taint tracking, YARA signatures, MCP least privilege, MCP tool poisoning—end-to-end attack surface coverage.

• Two-stage pipeline: Fast static scan (exec/eval/subprocess, etc.) + OSV.dev CVE lookup; optional LLM semantic pass (OpenAI, Anthropic, NVIDIA-compatible) for context/intent and human-readable explanations—balances speed and accuracy.

• Real-time vulnerability lookup: OSV.dev API, no key required, offline cache fallback—isolated environments still usable.

• Multi-format output: Terminal, JSON, Markdown, SARIF—SARIF for GitHub Code Scanning and enterprise CI.

• Risk scoring: 0–100—CRITICAL +50, HIGH +25, MEDIUM +10, LOW +5; executable scripts ×1.3. Bands: 0–20 LOW/SAFE, 21–50 MEDIUM/CAUTION, 51–80 HIGH/DO NOT INSTALL, 81–100 CRITICAL/DO NOT INSTALL.

3. How to Use

1. Environment: Python 3.8+, Git; uv or pip; Linux/macOS/Windows; network for deps and OSV (static scan works offline).

2. Install: git clone https://github.com/NVIDIA/skillspector.git; python -m venv venv; activate; make install (or make install-dev).

3. Scan: skillspector scan https://github.com/example/skill-repo.git or skillspector scan /path/to/skill-directory.

4. Optional LLM: Set SKILLSPECTOR_PROVIDER (openai/anthropic/nvidia) and API keys—e.g., export SKILLSPECTOR_PROVIDER=openai, export OPENAI_API_KEY=....

5. Reports: --format terminal|json|markdown|sarif and --output path.

6. Notes: First run may download pattern DB; protect API keys; offline OSV uses cache—may miss latest CVEs.

4. Pros and Cons

5. Comparison with Similar Tools

Selection advice: Agent skill security: SkillSpector best—platform-specific patterns and categories. Broader code security: Semgrep (open, rules) or Snyk (enterprise cloud intel). Cisco Skill Scanner: powerful commercial option for high-budget, high-assurance orgs.

6. Editor's Review

SkillSpector innovates in Agent security—two-stage static + LLM, 64 patterns across 16 categories including excessive agency and system prompt leaks that traditional SAST misses.

It addresses urgent need as Agent platforms proliferate—pre-install scan for developers, CI gates for enterprises, marketplace trust scores for platforms. 0–100 scoring and SARIF/JSON integrate cleanly.

Audience: Agent developers, security engineers, DevOps, marketplace admins.

Future: expand patterns, more LLM providers, more platforms, visual reports.

Open, comprehensive, innovative, high utility; −0.5 for LLM dependency and finite pattern set needing updates.

7. Use Cases

• Developer pre-install review: skillspector scan before third-party skills—score-driven install/skip.

• Enterprise CI gate: SARIF in GitHub Code Scanning—block high-risk skill PRs.

• Marketplace moderation: Batch scan submissions; display trust ratings.

• Author self-audit: Pre-release scan and fix from remediation guidance.

• Security research: Batch datasets for vulnerability trends and ecosystem baselines.

8. FAQ

Q: Supported inputs?
A: Git repo, URL, archive, directory, single file—auto-detected format.

Q: Enable LLM semantic analysis?
A: Set SKILLSPECTOR_PROVIDER and provider API key for stage-2 context/intent filtering.

Q: Risk score calculation?
A: CRITICAL +50, HIGH +25, MEDIUM +10, LOW +5; scripts ×1.3; bands 0–20, 21–50, 51–80, 81–100 as above.

Q: Offline scan?
A: Static fully offline; OSV falls back to local cache—may miss newest CVEs.

Q: CI/CD integration?
A: --format sarif --output report.sarif for GitHub Code Scanning and SARIF-capable CI.

Q: Custom patterns?
A: Not yet—NVIDIA plans extension APIs; contribute via GitHub issues/PRs.

9. Project Links

• GitHub: https://github.com/NVIDIA/skillspector