SkillSpector is NVIDIA's open-source scanner that checks skills for AI agents, such as those for Claude Code or Codex, for security risks before you install them.
In plain words
Skills are add-ons that agents run with a lot of trust and little checking. NVIDIA says that in a research set of 31,132 skills, 26.1% had vulnerabilities and 5.2% looked malicious. SkillSpector takes a Git repository, URL, zip file, folder or single file. A fast first pass looks for 71 known risk patterns, such as prompt injection and data exfiltration (secretly sending data out). An optional second pass has an LLM check whether the code matches the skill's stated purpose. Each scan gets a risk score from 0 to 100.
A quick example
Imagine you find a skill online that promises to tidy your project's files. Before installing it, you point SkillSpector at its repository and get a report with a risk score, which shows that the skill also sends files to an unknown server.
Where you'll meet it
- Checking agent skills before installing them.
- Gating skills in a build pipeline before release.
Related
Sources
- DocsNVIDIA/SkillSpector, NVIDIA (GitHub) · read 26 Oct 2026
- DocsScan Agent Skills Before Installation, NVIDIA Skill documentation · read 26 Oct 2026
Checked by WhatIsAI against the sources above · 26 Oct 2026. Spotted an error? Report it.