GitHub - NVIDIA/SkillSpector: Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks.

▤ Summary

NVIDIA is releasing SkillSpector, a security scanner for AI agent skills that checks for vulnerabilities, malicious patterns, and other risks before installation. The tool supports multiple input types, including Git repositories, URLs, zip files, directories, and individual files. It combines static analysis, optional LLM-based semantic review, and live OSV.dev vulnerability lookups, and it outputs results in terminal, JSON, Markdown, or SARIF formats. The report emphasizes risk scoring, severity labels, and clear recommendations to help users decide whether to install a skill. The article also highlights detection breadth, operational limits, and installation steps for using the tool in local or CI/CD workflows.

▦ Linked Companies

The Apache Software Foundation

$1M to $5M

OSV

up to $1M