SkillSpector: NVIDIA's Open-Source Security Scanner for AI Agent

lang: en #

title: “SkillSpector: NVIDIA’s Open-Source Security Scanner for AI Agent” description: ‘A security scanner for AI agent skills that detects vulnerabilities, malicious patterns, and security risks before installing agent skills. 10K stars from NVIDIA. Protect Claude Code, Codex CLI, and other agent frameworks.’ date: 2026-06-25 lastmod: 2026-06-25 draft: false github_repo: https://github.com/NVIDIA/SkillSpector category: dev-utils tags: [‘security’, ‘ai-agents’, ‘scanner’, ‘vulnerability-detection’, ‘claude-code’, ‘codex’, ‘mcp’, ‘agent-skills’, ’nvidia’] slug: skillspector-nvidia-open-source-security-scanner-ai-agent-skills license: Apache-2.0 faqs:

• q: “What is SkillSpector?” a: “SkillSpector is a developer utility tool that streamlines development workflows and improves productivity.”
• q: “How does SkillSpector integrate with existing tools?” a: “SkillSpector is designed to work alongside popular development tools, providing seamless integration through plugins, CLI commands, or API endpoints.”
• q: “Is SkillSpector compatible with Linux, macOS, and Windows?” a: “Most developer utilities support multiple platforms. Check the documentation for specific OS compatibility and installation instructions.”

lang: zh #

CC Switch: The Ultimate AI Coding Agent Manager for • Semgrep: The 15K-Star SAST Tool That Finds 500+ Vulnerabilities SkillSpector is a security scanning tool specifically designed for AI agent skills — the modular plugins and extensions that power frameworks like Claude Code, GitHub Copilot, Codex CLI, and Gemini CLI. Developed by NVIDIA with 10,273 GitHub stars, it addresses the growing security concerns around installing unvetted agent skills in production environments.

This article covers installation, scanning capabilities, vulnerability detection, integration with agent frameworks, and best practices for securing AI agent ecosystems.

TL;DR #

As AI agent skills become increasingly popular, so do the security risks of installing unvetted ones. SkillSpector provides automated scanning for over 800 cybersecurity skills, detecting vulnerabilities, malicious patterns, and security risks before they reach your system. It supports all major agent frameworks and provides actionable remediation guidance.

What Is SkillSpector? #

SkillSpector was born from a critical observation: as AI agent skills proliferate across developer workflows, the security surface area expands dramatically. Unlike traditional software packages that undergo rigorous code review, many agent skills are simple text files (SKILL.md) that instruct an LLM to perform arbitrary actions — including executing shell commands, accessing APIs, and modifying files.

The tool provides:

• Automated vulnerability scanning for AI agent skill files
• Pattern-based malicious behavior detection including command injection, data exfiltration, and privilege escalation
• Framework-specific analysis for Claude Code, GitHub Copilot, Codex CLI, and more
• Remediation guidance with specific fixes for detected vulnerabilities
• CI/CD integration for pre-installation scanning in automated pipelines

Installation Guide #

Prerequisites #

• Python: 3.12+ (required for async scanning features)
• Operating System: Linux, macOS, or Windows WSL2
• Disk Space: 500MB for scanner + skill databases
• Network: Required for downloading skill databases and updates

Option 1: Pip Installation #

a
s
h
# Install SkillSpector from PyPI
pip install skillspector

# Verify installation
skillspector --version

# Download the latest skill database
skillspector update-db

Option 2: From Source #

a
s
h
# Clone the repository
git clone https://github.com/NVIDIA/SkillSpector.git
cd SkillSpector

# Create virtual environment
python -m venv .venv
source .venv/bin/activate

# Install in development mode
pip install -e .

# Initialize the scanner
skillspector init --download-database

Option 3: Docker Deployment #

a
s
h
# Pull the official image
docker pull nvcr.io/nvidia/skillspector:latest

# Run a scan
docker run --rm \
  -v ${PWD}/skills:/app/skills \
  nvcr.io/nvidia/skillspector:latest \
  scan /app/skills

# Schedule regular scans
docker run -d \
  --name skillspector \
  -v ${PWD}/skills:/app/skills \
  -v ${PWD}/reports:/app/reports \
  nvcr.io/nvidia/skillspector:latest \
  daemon --interval 3600

Scanning Capabilities #

Vulnerability Detection Categories #

SkillSpector detects vulnerabilities across multiple categories:

| Category | Description | Severity | | Join the community: Telegram · HuggingFace

Internal links: nvidia-cosmos-world-models-platform-2026 · bytedance-ui-tars-desktop-ai-agent-guide

Disclosure: This article mentions tools that may have affiliate relationships. We do not accept payment for reviews. All opinions are our own.