NVIDIA's SkillSpector scans agent skills: 26.1% have at least one vulnerability
Fine_Airline_6832 · reddit · 2026-09-04
NVIDIA released SkillSpector, a static scanner for agent skills (SKILL.md, zip, git repos) that doesn't execute the skill and returns a 0-100 risk score, detecting prompt injection, hidden Unicode, tool poisoning in descriptions, and CVEs via OSV. Their research: 26.1% of skills in the wild have at least one vulnerability, 5.2% look malicious.
It also runs as an MCP server (skillspector mcp) with a single tool, scanskill, so an agent can gate an install on the verdict.
The poster runs MCP directory influzer.ai and asks the community: is SkillSpector a real pre-install gate or just a nicer grep? How to handle hosted MCPs with no cloneable tree, or false positives on GitHub-write servers?
Related event: NVIDIA open-sources SkillSpector to scan AI agent skills for risks(2 posts)→
More from coding & agent
- Dev's self-built tracker claims 7.1x speedup with Claude, 2.5 work-years banked — arthurcolle · 2026-10-21
- Librarian Agents: RL-trained agents build file systems, lifting RAG accuracy 44%→77% — simonguozirui · 2026-10-21
- Slack's first employee: living specs as source of truth, AI agents maintain the docs — josh_wills · 2026-10-21
- SpaceX support uses Grok Bot to clear 204 tickets in ~10 minutes — XFreeze · 2026-10-21
- GitHub Copilot's HydraFusion Orchestrates Multiple Models Per Task — WirelessLife · 2026-10-21
- Nous Research's Hermes now launches Cua Spaces for computer-use agents — alexcovo_eth · 2026-10-21