NVIDIA/SkillSpector

SkillSpector – Security scanner for AI‑agent skills

What it is – SkillSpector is an open‑source tool that checks AI‑agent “skills” (the plug‑in style code bundles used by agents such as Claude Code, Codex CLI, Gemini CLI, etc.) for known security problems before they are installed. It is part of NVIDIA’s Verified Skills pipeline, which signs and publishes safe skills to the NVIDIA skills catalog.

Why it matters – The README reports that in a sample of 31 k skills, more than a quarter contain vulnerabilities and a few percent show malicious intent. By scanning a skill early, developers can avoid deploying code that could leak prompts, exfiltrate data, or otherwise compromise the host system.

---

Core features (as described in the README)

• Multi‑source input – Scan a local directory, a single SKILL.md file, a zip archive, a Git URL, or any combination.
• 71 vulnerability patterns across 17 categories (e.g., prompt injection, data exfiltration, privilege escalation, supply‑chain attacks, tool misuse, memory poisoning, YARA signatures, etc.).
• Two‑stage analysis – Fast static analysis followed optionally by an LLM‑based semantic check.
• Live CVE look‑ups – Queries OSV.dev for up‑to‑date vulnerability data, with an offline fallback.
• Multiple report formats – Human‑friendly terminal output, JSON, Markdown, and SARIF (useful for CI/CD pipelines).
• Risk scoring – 0‑100 numeric score with severity labels and concrete remediation suggestions.
• Baseline / false‑positive suppression – Store a baseline file (.skillspector-baseline.yaml) to automatically silence known findings; only new issues appear on subsequent scans.
• Explicit scan‑scope control – Exclude paths via --exclude globs without relying on ignore files.
• LLM integration – Supports many providers (OpenAI, Anthropic, Bedrock, NVIDIA Build, Gemini, Ollama, Azure OpenAI, etc.) for the optional semantic stage, with sensible defaults and environment‑variable configuration.
• Batch scanning – Parallel scanning of many skills via the contrib/batch_scan module, with multilingual detection (zh/ja/ko) and configurable API‑key pools.
• MCP registry comparison – Compare two snapshots of an MCP registry to see what server identities changed, added, or removed.

---

Getting started

Installation (Python)

# CLI‑only (no MCP extras)
uv tool install git+https://github.com/NVIDIA/skillspector.git

# With MCP extra (required for `skillspector mcp`)
uv tool install 'skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git'

Alternatively, clone the repo and install via the provided Makefile (make install or make install-dev).

Docker (no Python needed)

make docker-build               # builds the image
docker run --rm -v "$PWD:/scan" skillspector scan ./my-skill/ --no-llm

Add an .env file or -e flags to supply LLM provider credentials.

---

Typical workflow

# 1. Scan a skill (static only)
skillspector scan ./my-skill/ --no-llm

# 2. Create a baseline after a manual review
skillspector baseline ./my-skill/ -o .skillspector-baseline.yaml

# 3. Re‑scan – only new findings are reported
skillspector scan ./my-skill/ --baseline .skillspector-baseline.yaml

Use --format json|markdown|sarif and --output <file> to export machine‑readable reports, e.g. for CI pipelines.

---

Extensibility & docs

• Development guide (docs/DEVELOPMENT.md) explains the analyzer pipeline and how to add new checks.
• Resource‑bounds docs (docs/ANALYSIS_RESOURCE_BOUNDS.md) describe ingest size caps that protect against zip‑bombs.
• Pi / OpenCode extensions let you invoke SkillSpector from inside an active agent session (/skillspector command).
• Suppression guide (docs/SUPPRESSION.md) details baseline formats and glob‑rule rules.

---

Who might use it

• AI‑agent developers who publish skills to the NVIDIA catalog or their own internal registry.
• Security teams that need to gate skill installation in CI/CD or on production agents.
• Ops engineers integrating skill safety checks into automated pipelines (SARIF output works with GitHub Actions, Azure Pipelines, etc.).

---

License & compatibility

• Licensed under Apache 2.0.
• Requires Python 3.12+ (or the provided Docker image based on python:3.12-slim-bookworm).

---

Bottom line

SkillSpector is a practical, open‑source security‑analysis tool focused on the emerging ecosystem of AI‑agent plug‑ins. It combines a large library of known vulnerability patterns with optional LLM‑driven semantic checks, offers flexible input sources and output formats, and integrates cleanly into both local development and CI/CD workflows.