NVIDIA open-sources SkillSpector, security scanner for AI agent skills and MCP tools

NVIDIA has open-sourced SkillSpector, a security scanner designed to evaluate AI agent skills before installation. The tool targets the growing ecosystem of agent capabilities used by Claude Code, Codex CLI, Gemini CLI, and other platforms, where skills execute with implicit trust and minimal vetting. NVIDIA's research on a 31,132-skill dataset found that 26.1% contained vulnerabilities and 5.2% showed likely malicious intent, motivating the need for pre-installation scanning.

SkillSpector performs two-stage analysis combining fast static analysis with optional LLM semantic evaluation, covering 71 vulnerability patterns across 17 categories including prompt injection, data exfiltration, privilege escalation, supply chain risks, MCP tool poisoning, and memory poisoning. The tool integrates with OSV.dev for live CVE lookups, outputs reports in Terminal, JSON, Markdown, and SARIF formats, and can be installed via uv, pip, or Docker. It also functions as an extension for Pi and OpenCode agent sessions, allowing in-session skill verification.

Scanner architecture and detection capabilities

• Two-stage analysis pipeline: Fast static analysis operates by default, with optional LLM semantic evaluation for deeper inspection; the static path requires no API keys while LLM mode needs provider credentials via environment variables.
• 71 vulnerability patterns across 17 categories: Detection covers prompt injection, data exfiltration, privilege escalation, supply chain compromise, excessive agency, output handling flaws, system prompt leakage, memory poisoning, tool misuse, rogue agent behavior, anti-refusal techniques, trigger abuse, dangerous code via AST analysis, taint tracking, YARA signatures, MCP least privilege violations, and MCP tool poisoning.
• Multi-format ingestion and bounded resource consumption: Scans Git repositories, URLs, zip files, local directories, or single files with fail-closed caps including INGEST_MAX_BYTES (100 MiB) for downloads and archives, INGEST_MAX_ZIP_MEMBERS (10,000) for zip entries, and MAX_FILE_BYTES (1 MB) per-file analysis limits.
• Live vulnerability correlation and offline resilience: SC4 module queries OSV.dev for real-time CVE data with automatic offline fallback when network access is unavailable.
• CI/CD integration and baseline management: Supports SARIF output for IDE and pipeline integration, plus glob-rule and fingerprint-based baselines to suppress known false positives and surface only new findings on re-scans.

Why it matters

SkillSpector addresses a critical gap in the rapidly expanding AI agent ecosystem, where MCP (Model Context Protocol) skills and similar extensions are increasingly distributed through public repositories without standardized security review. For Linux developers and system administrators deploying agent-based workflows, the tool provides a concrete mechanism to gate skill installation in CI/CD pipelines and containerized environments, with Docker support eliminating Python dependency concerns. The open-source release under NVIDIA's Verified Skills pipeline also establishes a transparent benchmark for what constitutes a security-passing skill, potentially pressuring other AI vendors to adopt or publish similar scanning methodologies rather than relying solely on proprietary review.