SkillSpector: Security Scanner for Agent Skills

Who it's for

SkillSpector is a security scanner for AI agent skills that NVIDIA provides on GitHub; its official purpose is to detect vulnerabilities, malicious patterns, and security risks before a skill is installed. It suits:

• Users about to install a third-party agent skill: for example, a skill archive downloaded from the community or a repository shared by someone else, where you want to confirm there are no malicious patterns or obvious vulnerabilities before putting it into your local agent.
• Maintainers who need to review where a skill comes from: scan inputs support Git repos, URLs, zip files, directories, or single files, covering different distribution forms.
• People who already have uv installed locally, whose agent supports MCP, and who want scanning available as a tool the agent can call directly.

Cases where it does not fit or you should be careful:

• It only performs static checks: the official documentation explicitly states it never executes the scanned skill, so a skill's actual runtime behavior is out of scope, and passing a scan does not mean it is safe to run.
• It targets the skill package itself and does not replace other security work such as system permissions or the dependency supply chain.
• Without uv, the official page gives no alternative installation method, and availability is unconfirmed.
• The scan's decision criteria and rule coverage are not documented officially; unconfirmed.

Your first attempt in 3 minutes

The most direct officially supported path: first install it from the GitHub repository as a CLI tool with uv, then invoke a scan once from a local agent that supports MCP.

Prerequisites: uv installed on your machine; agent-side MCP support.

Step 1, run the official install command in a terminal:

uv tool install git+https://github.com/NVIDIA/skillspector.git

Note the side effect: the official documentation states that the project will additionally download and install other third-party open source software; confirm you accept this before running it.

Step 2, connect scanning to your local agent. The official documentation says it runs as an MCP server, so local MCP-capable agents such as Claude Code, Codex CLI, and Gemini CLI can call scanning as a tool. The concrete way to register the MCP server (config file location, start command, and arguments) is not written on the official page; this article does not speculate — rely on the instructions in the repository.

Step 3, run a low-risk scan. Ask the agent in natural language to scan the directory or zip file containing a skill, for example: “Scan this skill directory and check for malicious patterns and security risks.” This is an analysis-only operation; the official documentation says the scanned skill is never executed.

Success signals: the Step 1 command finishes without errors; once connected, the agent can launch a scan as a tool and receive results. The concrete format and fields of the scan report are not described officially; unconfirmed — go by the actual output.

Use cases

Case 1: a security pre-check before installing a third-party skill. You get a skill zip from the community and want to install it into your agent. Instruct an MCP-capable agent: “Use the scanning tool to check this zip file and report any malicious patterns and security risks.” It will invoke the scan flow on this zip file (an officially supported input type) and return static analysis results. You can then decide whether to continue with the installation; since the check involves no execution, the skill's actual behavior still deserves your own attention.

Case 2: reviewing a skill repository you maintain. You maintain a skill in a Git repository and worry that a change has introduced a dangerous pattern. Have the agent scan that Git repository or its URL to see the issues found in the current version; the input is directly the repo or URL, no manual packaging needed, which suits a check after merging changes or on a schedule.

Limits of use

• File and command access: scanning is static analysis, and the official documentation explicitly states it never executes the scanned skill; whether it writes temporary files or accesses the network is not stated officially; unconfirmed.
• Installation side effect: the install command additionally downloads and installs third-party open source software — the clearest confirmation point before you run it.
• Environment and client prerequisites: uv is required; MCP-based invocation requires a local agent with MCP support, and the official documentation names Claude Code, Codex CLI, and Gemini CLI. Whether other agents work is unconfirmed — assume neither that it is limited to these three nor that every agent is supported.
• Use of results: scan results support your judgment; whether to install and how to proceed remains your decision. The official documentation does not state whether results can serve directly as a security audit conclusion; unconfirmed.
• Information not yet confirmed: the scan report format, supported operating systems, and network requirements are not mentioned on the official page; before use, rely on the latest documentation in the repository.