NVIDIA open-sources SkillSpector after scan finds 26% of 31k agent skills vulnerable
dunkhippo33 · x · 2026-10-22
- An analysis of 31,132 AI agent skills found 26.1% contained vulnerabilities and 5.2% looked malicious. NVIDIA has open-sourced SkillSpector, the scanner it uses before publishing skills to its own catalog (20.9K GitHub stars, Apache-2.0).
- It checks 71 attack patterns across 17 categories: prompt injection, data theft, privilege escalation, poisoned MCP tools and more supply-chain risks.
- Scans a GitHub repo, URL, zip or folder and gives a 0-100 risk score with recommendations; fast non-AI scan plus optional deeper AI review; works for Claude Code, Codex and Gemini CLI skills.
- Install: uv tool install git+https://github.com/NVIDIA/SkillSpector; scan: skillspector scan ./the-skill/ --no-llm.
More from coding & agent
- Walking bento box built with Claude Code + Blender Python, no MCP needed — sidahuj · 2026-10-22
- Indie dev building game #4 with AI starts with a central game asset management hub — ezshine · 2026-10-22
- Diffy: a cross-platform desktop code review app with a custom semantic diff engine — seatedro · 2026-10-22
- Crowdsourced AI agents push Quasi-RH boundary to θ=0.87477 with Lean verification — IgorCarron · 2026-10-22
- AgentMail hits 1B emails processed, up 50x in a year, as agents need inboxes — rohanpaul_ai · 2026-10-22
- UCLA x Apple open-source OpenVLHarness multimodal agent, gaining 9.7-12.6 points across 22 benchmarks — WeijiaShi2 · 2026-10-22