By ByteBot
One in four AI agent skills contains a vulnerability. Five percent show signs of likely malicious intent. Those numbers come from a scan of 42,447 skills — conducted before the current explosion of MCP and Claude Code registries made the problem significantly worse. NVIDIA shipped SkillSpector to give developers a fast, free answer to the question they should be asking before every install: is this safe?
The Numbers Should Make You Uncomfortable
The 26.1% vulnerability rate is not a rounding error. It comes from a study of 42,447 agent skills, and it means roughly one in four skills you might install into your Claude Code, Codex, or MCP workflow is shipping a problem you did not know about. The 5.2% malicious intent figure is more alarming — that is not developers being sloppy, that is deliberate compromise.
Snyk’s ToxicSkills study (February 2026) adds confirmation from a different angle. Researchers audited 3,984 skills from ClawHub and skills.sh and found 13.4% carrying at least one critical-level issue, with 1,467 malicious payloads across the dataset — credential harvesters, reverse shells, and crypto miners embedded in packages that look fine until they run. A separate audit of MCP community registries surfaced over 1,184 malicious packages. The ecosystem is growing faster than anyone is watching it.
Developers have been here before. The 2015–2018 npm supply chain era featured event-stream and left-pad poisoning, incidents that forced the industry to build npm audit into every workflow. Agent skills are at the same inflection point, without the lesson yet internalized.
What SkillSpector Does
SkillSpector is a free, open-source CLI from NVIDIA that takes a skill — directory, zip file, Git URL, or single file — and returns a 0–100 risk score with a SAFE, CAUTION, or DO NOT INSTALL verdict. It runs a two-pass pipeline.
The static AST pass runs in seconds. It walks the abstract syntax tree flagging exec, eval, subprocess, dynamic imports, dangerous code patterns, YARA signatures, and taint-tracked data flows. It also queries OSV.dev for live CVE matches, with automatic offline fallback.
The optional LLM semantic pass is slower but more precise. An OpenAI-compatible model reads the flagged code in context, prunes false positives, and writes a plain-language explanation of what it found. NVIDIA reports roughly 87% precision at this stage.
Across both passes, SkillSpector covers 71 vulnerability patterns in 17 categories: prompt injection, data exfiltration, privilege escalation, supply chain risks, MCP tool poisoning, memory poisoning, system prompt leakage, excessive agency, rogue agent behavior, anti-refusal techniques, and trigger abuse, among others. Output options are terminal text, JSON, Markdown, or SARIF for CI pipeline integration.
How to Use It
The fastest path is uvx, which installs and runs without cloning the repository:
uvx --from git+https://github.com/NVIDIA/SkillSpector skillspector ./my-skill/If you prefer pip:
pip install git+https://github.com/NVIDIA/SkillSpector.git
skillspector ./my-skill/You can point SkillSpector directly at a GitHub URL to scan before downloading:
skillspector https://github.com/some-user/some-claude-skillFor CI/CD, SARIF output integrates with GitHub Advanced Security and GitLab SAST. SkillSpector exits zero for scores of 50 or below, so a SAFE result passes CI by default:
skillspector ./my-skill/ --format sarif --output results.sarifSkillSpector also exposes a Python API built on LangGraph for programmatic invocation inside your own agent workflows or pre-install automation.
It Is Not a Silver Bullet — Use It Anyway
Research published by the Cloud Security Alliance in June found that Trail of Bits successfully embedded malicious logic — specifically, environment variable exfiltration — in precompiled bytecode alongside clean-looking source code. Scanners focused on readable source missed it entirely. The CSA report concluded that current skill scanners can be bypassed systematically.
That is a real limitation. Static analysis only reads what it can see, and a determined attacker who understands the scanner’s blind spots can exploit them. SkillSpector should be the first checkpoint, not the only one. Pair it with least-privilege permissions on the skills you install, manual review of anything that scores CAUTION, and a strong preference for skills with transparent source history and known maintainer identity.
That said: the tool catches the careless, the accidental, and the broadly distributed attacks — the overwhelming majority of that 26.1%. You do not need a zero-day to steal credentials from a developer who installed a skill from an unknown registry without scanning it first.
The Verdict
Make SkillSpector a required step in your skill install workflow. Run it before you install anything into Claude Code, Codex, or an MCP setup. Add the SARIF step to your CI pipeline if you manage team skill configurations. NVIDIA has catalogued 71 vulnerability patterns; the minimum you owe yourself is running the scan.
The ToxicSkills research and MCP registry audits confirm that the agent skill ecosystem is in its pre-npm audit era. SkillSpector is the tool that bridges that gap, today, for free. The OWASP Agentic Skills Top 10 project already lists SkillSpector as a recommended scanner integration. Treat it like infrastructure, not an optional extra.
