Radar / AI security / NVIDIA SkillSpector
NVIDIA SkillSpector: security scanner for AI agent skills, trending again
NVIDIA's open-source SkillSpector scanner is trending on GitHub today: it audits AI agent skills before installation, checking a repo, folder, zip or single file against 68+ vulnerability patterns across 17 categories — prompt injection, data exfiltration, supply-chain risks, MCP tool poisoning — and returns a 0-100 risk score. Apache 2.0, runs locally, no account; optional LLM semantic analysis on top of fast static checks.
Why it matters
The install path for agent skills has no review queue: a skill runs with the user's permissions the moment it lands, and the study SkillSpector cites found 26.1% of 42,447 surveyed skills carried at least one vulnerability.
What you could build with it
A developer-tools team could wire SkillSpector into continuous integration so any pull request that adds a new agent skill is blocked until its risk score passes, giving teams a pre-install gate for the skills their coding agents run.
Does it hold up?
Usable today as a pre-install gate: free, local, no account, one CLI install, and static checks need no API key; the optional LLM analysis is the only part that needs a provider key.
Built with NVIDIA SkillSpector
- Why AI Agent Skills Need a Registry, Not Just a Scannerarticle · Today's trending writeup: scanning answers whether a skill is safe to install, but not who published it or what it did after installation — the case for a registry on top.
- Skill Scanner resource guidearticle · Practitioner guide to installing SkillSpector via uv, scanning before install, and running it as an MCP server so Claude checks first.
- SkillSpector tool profilearticle · Tool profile noting the Apache 2.0 licence, 0-100 risk score with severity labels, and the March 2026 release.
Learn more
First spotted on github: source.
More AI security
iFixAi: independent auditing of AI agentsIndependent AI-agent auditor: 250+ inspections across 69 misalignment categories (red teaming + operational assurance)…security · JEV 0.76Cloudflare security-audit-skill: six-phase agent-driven security audits with independently verified findingsOpen-source MIT coding-agent skill that runs a codebase through six audit phases — reconnaissance, coverage-led…security · JEV 0.74OpenAI, Anthropic and Google DeepMind jointly unveil cyber-focused safety models and safeguardsThe three rival labs disclosed weeks of behind-the-scenes coordination and jointly released a set of cyber-focused AI…security · JEV 0.73OpenAI textGrain watermarking for ChatGPT and Codex in the EUOpenAI will roll out its invisible textGrain watermarking system to ChatGPT/Codex users in the EU over the coming…security · JEV 0.65Cloudflare security-audit-skill: multi-phase security audits for coding agentsA coding-agent skill that runs multi-phase security audits with independently verified, machine-checkable findings.security · JEV 0.63LiveNerf: a pre-registered benchmark for post-release model driftOpen-source, pre-registered 30-day benchmark that detects whether Claude Opus 5.5 quietly gets worse after launch.security · JEV 0.61
Get the week's best AI launches, plus 3 ideas worth building
One email every Saturday. Ranked by traction, not hype. Free.