SkillSpector scans agent skills before installation
August 15, 2026
NVIDIA's open-source scanner checks agent skills for prompt injection, data exfiltration, and risky permissions. It can run locally or in CI pipelines.
What this is about
Agent skills extend tools such as Codex CLI, Claude Code, or Gemini CLI with instructions, scripts, and access. That is both their value and their risk: a skill may execute commands, read files, or fetch additional components. NVIDIA SkillSpector is an open-source scanner that inspects such packages before installation.
Version 2.9.4, published on August 13, 2026, specifically hardens the handling of untrusted content. Among other changes, it blocks symlinks in skill packages and prevents remote MCP callers from selecting arbitrary local paths for scanning. This makes the release a concrete tool update rather than a general security story.
What SkillSpector actually does
SkillSpector accepts Git repositories, URLs, ZIP files, directories, or individual files. Its first stage is static: rules look for patterns such as prompt injection, data exfiltration, excessive permissions, dangerous code, manipulated tool descriptions, and risks in MCP configurations. An optional language model can add semantic evaluation.
Results are available in the terminal or as JSON, Markdown, and SARIF. This allows the scanner to run manually or as a gate in a CI pipeline. A risk score from 0 to 100 and severity levels help teams prioritize findings. Baselines can suppress reviewed findings so later runs mainly surface new deviations.
The project requires Python 3.12 or newer and recommends uv or pip. A Docker image can also be built locally. Static scans work without an external model; optional LLM analysis may require API credentials or a compatible local runtime.
Why it matters
An agent skill is not an ordinary text snippet. It can combine operational instructions, executable code, hooks, and permissions. Installing an unreviewed third-party skill expands the agent's trust boundary. SkillSpector targets the step before that expansion and provides a repeatable review before the new component receives access.
For development teams, SARIF is especially useful because findings can enter existing code and security workflows. Integration with OSV.dev supplements local analysis with known dependency vulnerabilities; when connectivity is unavailable, the project documentation says this part falls back to offline behavior. The Apache 2.0 license also permits internal modification and integration into custom review pipelines.
In plain language
The tool works like a security checkpoint at a factory gate. A delivery van is not admitted merely because the side says “tools.” The checkpoint inspects the load, paperwork, and unusual hiding places, while a human still makes the final decision.
A practical example
A team maintains 40 internal agent skills and wants to adopt a new skill from a public repository. Developers first run a static scan without an LLM and receive five findings: three low-level notices, one overly broad file permission, and one high-severity prompt-injection suspicion.
The team reviews the files, narrows the permission, and removes the suspicious instruction. It then stores the accepted low-level notices in a baseline and runs SkillSpector as a SARIF check on every change. The scanner does not decide that the skill is safe; it makes the review easier to audit and surfaces new deviations faster.
Scope and limits
First, an empty report is not proof of safety. Rule-based scanners can miss new attack patterns, while semantic models can produce false positives and incorrect judgments. Critical skills still need code review, restricted permissions, and runtime controls.
Second, optional LLM analysis depends on the selected provider and its privacy rules. Sensitive skill content should not be sent to an external service without review; a static-only or locally hosted analysis may be more appropriate.
Third, SkillSpector specializes in agent skills and related configuration. It does not replace a full malware sandbox, secret scanning, dependency review, or hardening of the agent host. Baselines can also hide genuine problems when findings are accepted without expert review.
A sensible next test is small: statically scan one known internal skill and one deliberately problematic test skill, validate the findings manually, and only then decide whether to add the scanner to CI.
SEO & GEO keywords
NVIDIA SkillSpector, agent skills, skill security, prompt injection, MCP security, supply chain security, Codex CLI, Claude Code, SARIF, OSV.dev, open-source security
💡 In plain English
SkillSpector checks agent skills for suspicious instructions, code, and permissions before installation. It provides findings and risk scores but does not replace human security review.
Key Takeaways
- →SkillSpector scans agent skills from repositories, URLs, archives, directories, and individual files.
- →Static checks work without an external language model; semantic analysis is optional.
- →JSON, Markdown, and SARIF output simplify integration into development and CI workflows.
- →Version 2.9.4 hardens protection against symlink traversal and local-path access through HTTP MCP.
- →A clean scan is not proof of safety and must be combined with reviews and least privilege.
FAQ
Is SkillSpector free to use?
Yes. The repository uses the Apache 2.0 license. Costs may arise if an external model provider is used for optional LLM analysis.
Does the scanner require a language model?
No. Static analysis runs without an LLM. A model is only needed for additional semantic evaluation.
Can SkillSpector run in CI?
Yes. SARIF and JSON output are particularly suitable for automated pipelines and downstream processing of findings.
Does a scan prove that a skill is safe?
No. The scanner can flag known patterns and suspicious behavior, but it may miss new attacks or context-specific issues. Manual review remains necessary.