HelloPixDig

Directory › Security › SkillSpector

SkillSpector
Image: official project repository

> GEM SECURITY · AGENT SKILLS · AGENTS & AUTOMATION

SkillSpector

by NVIDIA

NVIDIA's security scanner for AI agent skills: it spots prompt injections, data theft and dangerous code before you install a skill.

Apache-2.0 FreeOpen sourceLocal
View on GitHub →

What it does

  • 71 vulnerability patterns in 17 categories, risk score from 0 to 100
  • Scans a folder, a file, an archive or a GitHub repository directly
  • Free and local in static mode; read it critically, it produces false positives

! Tested by HelloPixDig on October 17, 2026 on 101 skills, in static mode: 34 rated safe, 58 “caution”, 9 “do not install”. After reading them by hand, the serious alerts were mostly false positives (API examples with a key, keys written to a .env file, files too long to analyze). It also spotted invisible characters, harmless here, but a known technique to hide instructions. A high score is not a verdict: read what it flags. The optional LLM mode needs a provider (API key); with a local model through Ollama, our attempt failed (timeouts). README figure: of 31,132 skills in a research dataset, 26.1% reportedly contain vulnerabilities and 5.2% likely malicious intent.

Install it

Requirements: Python and uv (or Docker). No key in static mode.

Install the tool
uv tool install git+https://github.com/NVIDIA/skillspector.git
Scan a skill before installing it (free mode)
skillspector scan ./mon-skill/ --no-llm
Or a GitHub repository directly
skillspector scan https://github.com/auteur/skill --no-llm

The prompt for your agent

Paste it into your coding agent: it checks the requirements and installs it for you.

Claude CodeCodexCursorGemini CLIopencode
Prompt
Install SkillSpector (https://github.com/NVIDIA/SkillSpector) on my machine.
1. Check the requirements: Python and uv (or Docker). No key in static mode. If anything is missing, tell me before installing anything.
2. Follow the official method:
- Install the tool: uv tool install git+https://github.com/NVIDIA/skillspector.git
- Scan a skill before installing it (free mode): skillspector scan ./mon-skill/ --no-llm
- Or a GitHub repository directly: skillspector scan https://github.com/auteur/skill --no-llm
3. Check that it works, then explain how to launch it and where to start.

Always review what your agent is about to run, especially install commands.