NVIDIA’s SkillSpector scans AI agent skills, finds 100% of malicious code

NVIDIA has released a new open-source tool called SkillSpector, and a hands-on test shows it’s remarkably effective at sniffing out dangerous code buried inside AI agent skills. The concept is crucial now because agent frameworks like LangChain and tools like MCP are pushing to give LLMs more autonomy—the ability to read, write, and execute code. That’s a security nightmare if the skills they’re given are poisoned.

The tutorial I reviewed constructs a synthetic marketplace of skills you might see in a real deployment: a benign PDF summarizer, a shifty repo janitor with a blatant shell=True injection, and a full-on malicious invoice-sync skill packed with prompt injections, typosquatted dependencies, and a hidden persistence mechanism. Running SkillSpector against this rogue’s gallery is straightforward. Its LangGraph-based pipeline breaks analysis into discrete, pluggable steps, checking everything from SKILL.md metadata for prompt injection to static analysis of scripts for shell execution.

What’s immediately valuable is the output. The scanner doesn’t just flag a skill as ‘bad’; it assigns a risk score, a confidence level, and specific, categorized findings. For the malicious invoice-sync skill, it correctly surfaced the hidden system prompt override, the cronjob persistence, and the suspicious typosquatted package reqeusts. The framework also shows which analyzers ran to completion, so you can see if a scan was partial.

The tutorial goes beyond a simple scan, building a full governance workflow. It demonstrates generating SARIF and Markdown reports for compliance, establishing a baseline of accepted risks to suppress known false positives, and then detecting regressions when a skill changes. The ability to extend the graph with custom YARA rules for organization-specific secrets detection is a practical touch that enterprise teams will appreciate. The final piece—enforcing a CI security gate that fails a build on new high-severity findings—turns SkillSpector from a diagnostic tool into an active policy enforcer. My take? This fills a glaring gap. We’re racing to give agents tools, but scanning those tools is an afterthought. SkillSpector makes it a programmable step.