Check AI agent skills for hidden malicious code before installation
If you want to verify that a new skill for an AI agent like Claude Code or Codex is not stealing data or attempting to seize system privileges, this tool is for you. SkillSpector scans skill files or repositories to identify 71 vulnerability patterns and assigns a risk score from 0 to 100, answering the question of whether a skill is safe to install. Running it before installation filters out malicious code, allowing the agent to operate in a trusted environment.
Why skill security is needed
AI agent skills typically receive execution privileges without separate verification procedures. Analysis of a research dataset of 31,132 skills found that 26.1% contained vulnerabilities and 5.2% showed signs of malicious intent. SkillSpector is designed to block these risks in advance. As part of the NVIDIA Verified Skills pipeline, the tool supports scanning, evaluation, and signing before a skill is published. Only skills that pass are posted to the NVIDIA skill catalog.
Detecting danger signals with 71 patterns
SkillSpector detects 71 vulnerability patterns across 17 categories, including prompt injection, data exfiltration, privilege escalation, and supply chain attacks.
- Prompt injection detection Detects six patterns that ignore safety constraints or contain hidden instructions.
- Data exfiltration tracking Analyzes four exfiltration paths, such as environment variable collection, file system enumeration, and external transmission of conversation context.
- Supply chain risk management Checks for more than 10 supply chain attack signatures, including unfixed dependencies, malicious bytecode, and typosquatting.
- Code structure analysis Detects dangerous code-level behaviors, such as
exec()calls, dynamic imports, and risky execution chains, using an AST (Abstract Syntax Tree) basis.
Installation and usage
SkillSpector is a Python-based tool that can be installed via uv or pip. You can also use a Docker image to run it without setting up a separate Python environment. The basic usage involves running the skillspector scan ./my-skill/ command. It supports various input formats, including Git repository URLs, zip files, directories, and single files. If you want LLM-based deep analysis, set the API key for providers like OpenAI, Anthropic, or Bedrock as an environment variable. To skip LLM analysis and perform only fast static analysis, add the --no-llm option.
Pre-use considerations
While SkillSpector judges the safety of skills, it does not guarantee 100% blocking of all risks. Specifically, when using LLM analysis, support for structured output may vary depending on the selected model, which can cause HTTP 400 errors. Additionally, remote inputs are subject to a 100 MiB download limit and a 10,000 zip member limit; exceeding these stops execution. If running as an MCP server, HTTP transport is provided without authentication, so you must configure an authenticating reverse proxy before exposing it to external networks. Although the tool integrates with NVIDIA's verification pipeline, it is important to maintain the latest version of the vulnerability pattern database when using it independently.
