SkillSpector: NVIDIA’s open-source security scanner for AI agent skills

SkillSpector is an open-source scanner from NVIDIA that inspects agent skills (Markdown plus optional scripts) to identify risky constructs—exec/eval usage, tainted environment variables, malicious regex/YARA matches, dependency CVEs, prompt-injection patterns, and more. It performs a fast static pass and an optional LLM-assisted second pass to reduce false positives, produces a risk score and recommendations, and emits JSON/Markdown/SARIF outputs for automation and review.