SkillSpector: NVIDIA’s open-source security scanner for AI agent skills SkillSpector is an open-source scanner from NVIDIA that reads an agent skill and tells you whether to install it. Point it at a directory, a zip file, a single SKILL.md, or a Git URL, and it returns a list of findings, a risk score, and recommendations. The folder it reads runs with everything you have. A skill is Markdown instructing the agent, sometimes with a Python script beside it that reaches the shell, the environment variables, and the SSH directory. The script is where risk concentrates. The study behind the tool found skills that ship one are 2.12x more likely to be vulnerable. Agents load them on trust. How it reads a skill The first pass is static and takes seconds. An AST walk flags exec, eval, subprocess, and dynamic imports. A taint tracker follows environment variables and file contents to network sinks. YARA rules match known malware, webshells, and cryptominers. Regex analyzers handle the rest of the 64 detection patterns, covering prompt injection, credential access, memory poisoning, typosquatted dependencies, and cron-job persistence. Some patterns exist only because a skill is a prompt. One flags a trigger that shadows a built-in command, so the agent reaches for the skill when the user typed something ordinary. Another flags homoglyphs and right-to-left overrides in tool metadata. A third flags zero-width characters and HTML comments carrying directives a human reviewer scrolls right past. Dependency checking goes out to the network. SkillSpector batches a skill’s package list into one query to OSV.dev, gets back known CVEs, and caches the answer for an hour. An air-gapped run falls back to a small built-in list. A second pass is optional, slower, and off until you configure it: it needs an OpenAI-compatible endpoint and a key, set through