As developers increasingly rely on autonomous AI agents to write code, manage infrastructure, and execute complex workflows, third-party AI agent skills have introduced a major supply-chain threat vector. Because these skills run with elevated system permissions and implicit user trust, NVIDIA released SkillSpector—a dedicated open-source security tool designed to answer a single critical question: Is this agent skill safe to install?
Why Agent Skills Present Unique Threat Vectors
Unlike standard software libraries that fail predictably, AI agent skills contain executable logic, prompt instructions, system context overrides, and tool definitions. This hybrid structure opens up unique attack paths:
According to NVIDIA’s security telemetry, over a quarter of evaluated agent skills exhibit structural security weaknesses, while over 5% contain active exfiltration or backdoor routines.
Comprehensive Vulnerability Coverage
SkillSpector inspects skill packages across 71 vulnerability patterns grouped into 17 core security categories:
- Prompt injection
- Data exfiltration
- Privilege escalation
- Supply-chain issues
- Excessive agency
- Output handling
- System prompt leakage
- Memory poisoning
- Tool misuse
- Rogue-agent behavior
- Trigger abuse
- Dangerous code patterns
- Taint tracking
- YARA signatures
- MCP least privilege
- MCP tool poisoning
1. Prompt Injection & Anti-Refusal: Flags hidden system-prompt overrides engineered to bypass agent safety boundaries.
2. Data Exfiltration & Credential Theft: Identifies routines constructing outbound HTTP payloads to exfiltrate local `.env` files, SSH keys, cloud tokens, or browser cookies.
3. Model Context Protocol (MCP) Least Privilege: Evaluates MCP tool definitions to catch tool poisoning and overbroad filesystem or shell permissions.
4. Dangerous Code Patterns & AST Taint Tracking: Detects obfuscated scripts, dangerous API invocations, and memory poisoning routines embedded within Markdown files or skill wrappers.
5. Supply-Chain Correlation: Integrates directly with OSV.dev for live, real-time vulnerability checks against external dependencies (with automatic offline fallback).
Static vs. Semantic Analysis Pipeline
SkillSpector leverages a hybrid evaluation model depending on the depth of inspection required:
- Static Analysis (Fast & Deterministic): Scans file structures, AST nodes, and dependency manifests. It catches known malicious strings, risky API calls, and declared permission anomalies without requiring LLM API calls.
- Semantic Analysis (LLM-Driven): Uses an LLM provider (supporting OpenAI, Anthropic, DeepSeek, or Gemini) to analyze what a skill claims to do in its description versus what its underlying code actually attempts to execute, surfacing hidden prompt injection or subtle policy breaches.
NVIDIA Official Triage & Release Gating Matrix
In its official technical documentation, NVIDIA outlines clear remediation guidelines for enterprise security teams and maintainers:
| Finding Category | Severity Level | Mandated Triage / Action Policy |
| Critical or High Severity Flaw | Critical / High | Block Release until resolved or formally accepted via baseline rules. |
| Hidden Instructions / Tool Poisoning | Critical | Purge Concealed Content before publishing or installing. |
| Underdeclared Capability | High | Update Manifest Permissions or strip unauthorized code routines. |
| Known Vulnerable Dependency | Medium / High | Upgrade & Pin Package Version or document formal risk acceptance. |
| Description-Behavior Mismatch | Medium | Rewrite Skill Card Description or alter backend code to align intent. |
Quick-Start & Operational Deployment
SkillSpector can be deployed via Python package managers, CLI utilities, or isolated Docker containers:
Quick Install (via `uv` or pip):
git clone https://github.com/NVIDIA/SkillSpector.git
cd SkillSpector
uv venv .venv && source .venv/bin/activate
make install
If uv is unavailable, use Python’s built-in virtual environment support:
python3 -m venv .venv
source .venv/bin/activate
make install
Run a Scan
# Scan a local skill directory
skillspector scan ./my-skill/
# Scan a single SKILL.md file
skillspector scan ./SKILL.md
# Scan a Git repository
skillspector scan https://github.com/user/my-skill
# Scan a zip file
skillspector scan ./my-skill.zip
Docker Container Execution (No Local Python Needed):
docker run --rm -v "$PWD:/scan" skillspector scan ./my-skill/ --no-llm
CI/CD Pipeline Integration (SARIF Export):
skillspector scan ./my-skill/ --format sarif --output report.sarif
