NVIDIA open-sources SkillSpector, a scanner for risky AI agent skills
dr_cintas · x · 2026-07-23
NVIDIA has open-sourced SkillSpector, a security scanner for AI agent skills used by tools like Claude Code, Codex CLI, and Gemini CLI.
- It can scan a skill from a folder, single file, GitHub link, or zip archive.
- The tool runs a fast static pass to flag credential harvesting, data leaks, and known CVEs in dependencies.
- An optional LLM pass then checks intent to reduce false positives.
- Output is a single risk score from 0 to 100 with a plain verdict: safe, caution, or do not install.
- The README says it is free and includes support for multi-format input, multiple output formats, and checks for patterns like prompt injection, data exfiltration, privilege escalation, and MCP tool poisoning.
Related event: NVIDIA Open-Sources SkillSpector for AI Agent Security(3 posts)→
More from coding & agent
- Redditor seeks real-world stacks for a persistent-memory personal AI that answers texts and emails — BrooksomidusGG · 2026-10-27
- Practical tip: use max effort for planning, xhigh for implementation in Claude Code — majidmanzarpour · 2026-10-27
- Chrome team explains WebMCP: agents get tools from your website, not a replacement for MCP — rseroter · 2026-10-27
- Agent-Native apps: why agents bypassing your UI can break business rules — rseroter · 2026-10-27
- 'My intelligence stack': developer splits AI coding work across Opus 5.5, Fable and Astra with human review gates — sh_reya · 2026-10-27
- Baseten webinar: evaluate open models for coding agents by benchmarking on your own merged PRs — baseten · 2026-10-27