SkillSpector: Scan AI Agent Skills for Threats Before You Install Them

1. What Is SkillSpector?

SkillSpector is a security scanner for AI agent skills: the folders of instructions and scripts that tools like Claude Code, Codex CLI or Gemini CLI load on demand. You point it at a skill (a directory, a single SKILL.md, a zip or a Git URL) and it reports vulnerabilities, malicious patterns and a 0–100 risk score with an install recommendation. The project is published by NVIDIA under Apache-2.0 and written in Python.

Read from the GitHub API and the README on 2026-10-14. Stars move daily; the repo was created in March 2026.

The README says it is part of NVIDIA’s Verified Skills pipeline, which scans, evaluates and signs agent skills before publication. That context matters: it was designed as a gate for a publisher’s catalog, and it doubles as a pre-install check for anyone consuming skills.

2. How It Works: Four Steps From Input to Verdict

The README describes a two-stage detection pipeline wrapped by an intake step and a scoring step. Nothing in it executes the skill: the trust model states plainly that it never runs what it scans.

3. What It Checks: 17 Categories of Skill Risk

This is the README’s own taxonomy. Each category has numbered rule IDs (P1, E2, SC4, AST1, TT3…) that show up in reports and baselines, so you can talk about a finding precisely.

4. Quickstart: Verified Against the README on 2026-10-14

Every command below is copied from the project README as of today (Python 3.12+ per its badge). I am documenting them here, not running them for you: read what an installer does before you execute it, which is the whole point of this article.

uv tool install git+https://github.com/NVIDIA/skillspector.git

# Scan a local skill directory
skillspector scan ./my-skill/

# Scan a single SKILL.md file
skillspector scan ./SKILL.md

# Scan a Git repository
skillspector scan https://github.com/user/my-skill

# Scan a zip file
skillspector scan ./my-skill.zip

# JSON output - machine readable
skillspector scan ./my-skill/ --format json --output report.json

# Markdown output - for documentation
skillspector scan ./my-skill/ --format markdown --output report.md

# SARIF output - for CI/CD integration and IDE tooling
skillspector scan ./my-skill/ --format sarif --output report.sarif

docker build -t skillspector .
docker run --rm -v "$PWD:/scan" skillspector scan ./my-skill/ --no-llm

5. Wire It Into CI Before Third-Party Skills Reach Your Agent

The README calls the exit code and the JSON output a stable contract for CI pipelines, install gates and editor integrations. It does not ship a GitHub Actions snippet, so the script below is my own composition of documented flags. I have not run it: test it on a throwaway repository first.

The pre-install workflow I would use

1. Step 1 — Quarantine: Never drop a third-party skill straight into ~/.claude/skills/. Pull it into a scratch directory or let SkillSpector fetch the Git URL itself.
2. Step 2 — Scan static-first: Run with --no-llm so nothing leaves your machine. Add the LLM stage only for skills you are allowed to share with a provider.
3. Step 3 — Read verdict and coverage: Check risk_assessment.recommendation and analysis_completeness.is_complete in the JSON. NVIDIA’s docs say an incomplete scan is not safe to install, whatever the score.
4. Step 4 — Human review, then project scope: A person reads SKILL.md and every flagged script, then the skill goes into the repo, where later changes show up in a pull request.

Illustrative CI gate (composed from documented flags, not copied from the README)

#!/usr/bin/env bash
# ci/scan-skills.sh - fail the build if a vendored skill is risky or unreadable
set -u

# Pin a release tag so scores do not drift between runs (uv accepts git refs after @)
uv tool install git+https://github.com/NVIDIA/skillspector.git@v2.12.0

mkdir -p reports
status=0
for d in .claude/skills/*/; do
  skillspector scan "$d" --no-llm \
    --fail-on-findings --fail-on-incomplete \
    --format sarif --output "reports/$(basename "$d").sarif" || status=1
done
exit $status

skillspector baseline ./my-skill/ -o .skillspector-baseline.yaml
skillspector scan ./my-skill/ --baseline .skillspector-baseline.yaml

6. Use Cases That Earn Their Keep

Four places where a static skill scanner is worth the setup time.

uv tool install 'skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git'
claude mcp add skillspector -- skillspector mcp

7. Where It Fits: Scanner Before, Sandbox During

The README is explicit that SkillSpector is defense-in-depth, not a sandbox: it never executes the skill, and it does not contain a skill you install anyway. Those are two different controls answering two different questions.

8. When Not to Rely on It: The False Sense of Safety

A clean report is the most dangerous output this tool can produce, because it feels like permission. The README’s Limitations section is short and worth taking literally.

Conclusion

SkillSpector earns its stars by doing one unglamorous job well: turning “is this skill sketchy?” from a gut feeling into a repeatable check with rule IDs, a score and an exit code. For anyone installing skills from strangers, which in 2026 is most of us, that is worth ten minutes to set up.

Use it as the first filter, not the last. Scan static-first, gate on completeness, install at project scope and keep a sandbox under anything that runs code. If your agents already pull skills from everywhere and nobody owns that audit, that is the kind of gap I close in project-rescue work.