NVIDIA open-sources SkillSpector, a scanner for risky AI agent skills
dr_cintas · x · 2026-07-23
NVIDIA has open-sourced SkillSpector, a security scanner for AI agent skills used by tools like Claude Code, Codex CLI, and Gemini CLI.
- It can scan a skill from a folder, single file, GitHub link, or zip archive.
- The tool runs a fast static pass to flag credential harvesting, data leaks, and known CVEs in dependencies.
- An optional LLM pass then checks intent to reduce false positives.
- Output is a single risk score from 0 to 100 with a plain verdict: safe, caution, or do not install.
- The README says it is free and includes support for multi-format input, multiple output formats, and checks for patterns like prompt injection, data exfiltration, privilege escalation, and MCP tool poisoning.
Related event: NVIDIA Open-Sources SkillSpector for AI Agent Security(3 posts)→
More from coding & agent
- WanGP adds one-click AMD GPU support for Tencent's Hy-Nomas world model, runs on 8GB VRAM — cocktailpeanut · 2026-10-27
- He benchmarks new models by having them build their own copilot — $28 of compute — bucolucas · 2026-10-27
- Founder generates 46 app promo videos in 4 days with Claude, skipping $11,500 in UGC fees — PrajwalTomar_ · 2026-10-27
- Should agents be allowed to change plans mid-task? Reddit debates the drift boundary — wistfulcracker84 · 2026-10-27
- HeyGen + Canva MCP turns slide speaker notes into an avatar presentation video — HeyGen · 2026-10-27
- Local beats cloud: Qwen 3.8 FN handles private student data as well as frontier models — dr_lm · 2026-10-27