SkillSpector
Scan any AI agent skill for hidden vulnerabilities before you install it
26.1%
of scanned skills had a real vulnerability
5.2%
showed signs of actual malicious intent
71
known risk patterns checked, across 17 categories
What it actually does
Right now, installing an AI agent skill means trusting a stranger's code with almost no vetting -- you download it, you run it, you hope. SkillSpector is NVIDIA's answer: point it at a skill before you install it, and it tells you what's actually wrong, not just that something might be. The number that got this on our radar: NVIDIA scanned a batch of public skills and found over a quarter had real vulnerabilities, with about 1 in 20 showing signs of genuinely malicious intent.
Why it's worth your time
- Scans any AI skill for hidden vulnerabilities before it ever touches your machine.
- Checks for 71 known risk patterns across 17 categories -- prompt injection, data exfiltration, the works.
- Pulls live vulnerability data from OSV.dev instead of running off a stale local rulebook.
- Hands you a 0-100 risk score and a straight install-or-don't call, not a wall of warnings to parse yourself.
- Takes a GitHub repo, a URL, a zip file, or a plain folder -- scan it however you actually found it.
Before you start
- Python 3.12+ (or skip it entirely and use Docker)
- A GitHub repo, URL, zip file, or local folder to point it at
- Optional: an OpenAI, Anthropic, or Ollama key for deeper semantic checks beyond the fast static scan
🆕 New to the command line? Start here
SkillSpector isn't a Claude feature -- it runs completely on its own, so you don't need Claude Code or any AI subscription to use it. All you need is a terminal, a plain text window that's already built into your computer.
1. Open a terminal
- Mac: press
Cmd + Space, type "Terminal", press Enter. - Windows: press the Windows key, type "Terminal" or "PowerShell", press Enter.
2. Install uv first -- the Python package manager the quick-install command below uses
Mac
curl -LsSf https://astral.sh/uv/install.sh | shWindows
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"3. Then paste the install command below into that same window and press Enter. That's the whole install.
Already use Claude Code (the desktop app, claude.ai/code in a browser, or the CLI)? You can skip opening a terminal yourself -- paste the install command below into a Claude Code chat and ask it to run it for you, it has real terminal access built in. Claude Cowork specifically can't do this on its own -- it's built for working with files and documents, not for running command-line tools.
Install it
Quickest -- install the CLI
uv tool install git+https://github.com/NVIDIA/skillspector.gitNo Python at all -- Docker
make docker-build
docker run --rm -v "$PWD:/scan" skillspector scan ./my-skill/From source
git clone https://github.com/NVIDIA/skillspector.git
cd skillspector
uv venv .venv && source .venv/bin/activate
make installUse it
Run a scan
skillspector scan ./my-skill/Static checks only, no LLM call
skillspector scan ./my-skill/ --no-llm