NVIDIA/SkillSpector: the security scanner you should run before installing your next agent skill

What it does

Why this exists now

"Our findings reveal pervasive security risks: 26.1% of skills contain at least one vulnerability, spanning 14 distinct patterns across four categories." 3

"Detecting malicious skills therefore demands joint reasoning over a skill's task, code, and instructions." 4

How it works

Install steps

# Clone and set up a virtual environment (Python 3.12+ required)
git clone https://github.com/NVIDIA/skillspector.git
cd skillspector
uv venv .venv && source .venv/bin/activate  # or: python3 -m venv .venv
make install                                 # production install
# make install-dev                          # includes dev/test dependencies

# OpenAI (default model: gpt-5.4)
export SKILLSPECTOR_PROVIDER=openai
export OPENAI_API_KEY=sk-...

# Anthropic (default model: claude-opus-4-6)
export SKILLSPECTOR_PROVIDER=anthropic
export ANTHROPIC_API_KEY=sk-ant-...

# NVIDIA build (default model: deepseek-ai/deepseek-v4-flash)
export SKILLSPECTOR_PROVIDER=nv_build
export NVIDIA_INFERENCE_KEY=nvapi-...

# Local Ollama (no API costs)
export SKILLSPECTOR_PROVIDER=openai
export OPENAI_API_KEY=ollama
export OPENAI_BASE_URL=http://localhost:11434/v1
export SKILLSPECTOR_MODEL=llama3.1:8b

Usage examples

# Scan a local skill directory
skillspector scan ./my-skill/

# Scan a single SKILL.md file
skillspector scan ./SKILL.md

# Scan a GitHub repo directly
skillspector scan https://github.com/user/my-skill

# Skip LLM analysis (faster, static only)
skillspector scan ./my-skill/ --no-llm

# Output SARIF for CI/CD integration
skillspector scan ./my-skill/ --format sarif --output report.sarif

# JSON output for programmatic processing
skillspector scan ./my-skill/ --format json --output report.json

What production data says about its accuracy

• SkillSpector flagged 48.7% of all 67,453 skills as positive — the highest rate of any scanner
• VirusTotal flagged 7.75%; static analysis flagged 6.57%
• Jaccard agreement between any two scanners: 6.5–10.4%
• Only 468 skills (0.69%) were flagged by all three simultaneously
• 81.9% of positive findings came from a single scanner alone

"We do not believe these findings point toward an issue with any of the individual scanners. Rather, each scanner has a different risk surface." 9

"The next major enterprise breach won't come from yet another misconfigured S3 bucket... It'll come from an AI agent skill someone installed in 30 seconds." 11

Known limitations

1. Several analyzers are stubs. The behavioral taint tracking, MCP privilege, MCP tool poisoning, and semantic quality analyzers in v2.1.3 are not fully implemented. 6 The 64-pattern coverage number reflects the design; actual enforcement is a subset of that.
2. High false-positive rate at the suspicious tier. SkillSpector flagged 48.7% of 67,453 skills positive in the OpenClaw study. 9 Running it against any moderately complex skill library without LLM filtering will generate a lot of noise.
3. Weak on actual malware. As noted above: among definitively malicious skills in the OpenClaw dataset, SkillSpector caught 6.8% vs. VirusTotal's 72.8%. 9 If traditional malware delivery is your threat model, VirusTotal is the more relevant tool.
4. No pip install skillspector one-liner yet. The current install path requires cloning the repo and running make install. A PyPI-published package would be more practical for CI/CD integration.
5. Version mismatch signal. The published version number is 2.1.3, but the public repository has only 16 commits. 1 A large pre-publication history exists, but it's not publicly visible. For a security tool, opaque version history is worth factoring into your trust model.
6. No benchmark on the current version. The 86.7% precision / 82.5% recall figures from arXiv:2601.10338 describe the earlier SkillScan research framework, not SkillSpector v2.1.3 specifically. 3 Ground-truth evaluation of the current release has not been published.

When NOT to use this

• Your threat model is traditional malware delivery. SkillSpector won't catch a trojanized dependency with the reliability of VirusTotal. Run both, or use OpenClaw's ClawScan which synthesizes all three. 9
• You need a fully implemented MCP audit. The MCP-specific analyzers (mcp_least_privilege, mcp_tool_poisoning) are currently stubs. If MCP tool poisoning is your primary concern, watch the GitHub issues for when these ship. 6
• You want zero-noise CI blocking. The 48.7% positive rate on production skills means you will block legitimate installs at scale. Use --no-llm for fast pre-screening and reserve full LLM analysis for skills that cross a score threshold.
• You need a one-command install without managing a Python environment. The current install requires uv or venv setup; this isn't a npx tool.

• You install third-party skills regularly and have no vetting step today. Even the static analysis pass (Stage 1, --no-llm) catches supply chain issues and AST-level dangerous patterns that no one else checks before the skill hits your agent.
• You want to run NVIDIA's own verification pass locally before submitting a skill for official review.
• You're building a skill distribution pipeline or marketplace and need structured output. SARIF format plus the JSON report feed directly into Code Scanning and other automated workflows.
• You care about the agentic-specific threat surface — prompt injection, excessive agency, tool poisoning — that generic static analysis and virus scanners weren't built to detect.

Try it now

# Clone and install
git clone https://github.com/NVIDIA/skillspector.git
cd skillspector && uv venv .venv && source .venv/bin/activate
make install

# Static-only scan of a skill (no API key needed)
skillspector scan https://github.com/some-user/some-skill --no-llm

# Full scan with Anthropic backend
export SKILLSPECTOR_PROVIDER=anthropic
export ANTHROPIC_API_KEY=sk-ant-...
skillspector scan ./path/to/skill/