NVIDIA's SkillSpector: Scan AI Agent Skills for Security Vulnerabilities Before Install
An open-source tool backed by NVIDIA research to assess the safety of AI skills for coding agents, addressing a critical supply chain risk.
Practical Summary
NVIDIA has released SkillSpector, an open-source scanner designed to evaluate the security of AI agent skills (plugins) used in tools like Claude Code, Codex, and Cursor. It assigns a safety score to flag vulnerabilities and malicious code before installation.
Why It Matters
With over a quarter of AI skills reportedly containing vulnerabilities, this tool provides a practical, proactive security step for developers integrating AI agents into their workflows. It helps protect against data exfiltration and credential theft, directly impacting development security and cost.
Understanding the SkillSpector Scanner
SkillSpector is an open-source security scanner built by NVIDIA and backed by published research. It analyzes AI agent skills—the plugins or extensions used by coding assistants—to identify security risks before they are deployed in your environment.
What It Detects
The scanner is designed to catch specific attack patterns in AI workflows, including environment variable harvesting (to steal API keys), hidden external data transmission, obfuscated code, and credential exfiltration. It provides a quantifiable safety score from 0 to 100.
Practical Application
To use SkillSpector, you point it at an AI skill intended for a supported agent platform (e.g., Claude Code, OpenAI Codex, Gemini CLI, Cursor). The tool analyzes the skill's code and returns a safety report, allowing you to decide whether to install it based on the score and identified vulnerabilities.
