SkillSpector: the open-source NVIDIA scanner to assess risks in AI agent skills

NVIDIA Releases SkillSpector: The Open-Source Scanner for AI Agent Security

NVIDIA has published SkillSpector, an open-source tool designed to analyze vulnerabilities in AI agent skills. This scanner reads Markdown files and associated Python scripts, assessing security risks before installation. The tool examines directories, ZIP archives, individual SKILL.md files, or Git repositories, providing a list of vulnerabilities, a risk score, and mitigation recommendations.

Quick Response

How SkillSpector Works

The analysis process of SkillSpector begins with a static scan that takes a few seconds. It uses an AST walk to identify risky functions such as exec, eval, subprocess, and dynamic imports. A taint tracker follows environment variables and file content to network sinks. YARA rules are used to detect known malware, webshells, and cryptominers.

The tool also implements 64 detection patterns, including prompt injection, credential access, memory poisoning, typosquatted dependencies, and cron-job persistence. Some patterns are specific to skills, such as detecting triggers that shadow built-in commands, omoglyphs, right-to-left overrides in metadata, and zero-width characters.

Dependency Analysis and Optional Scanning

SkillSpector performs dependency checks by querying OSV.dev with the skill's package list, obtaining known CVEs and storing results for an hour. In air-gapped mode, the tool uses a small built-in list. An optional, slower analysis requires an OpenAI-compatible endpoint and key, configured via SKILLSPECTOR_PROVIDER.

This second pass uses an LLM to read the flagged code, reduce false positives, and generate actionable explanations, with an estimated precision of 87%. The prompt includes anti-jailbreak instructions to prevent model manipulation.

Risk Score Calculation

Each detected vulnerability contributes to the risk score, with different weights based on severity. A score above 50 indicates that the skill should not be installed. The presence of executable content multiplies the score by 1.3. Two high-severity vulnerabilities in a skill that includes a Python script can exceed the safety threshold.

Using the Results

SkillSpector provides results in various formats: terminal output for users, JSON for scripting, Markdown for reviews, and SARIF for CI/CD pipeline integration. The --no-llm flag disables the second pass, reducing false positives but maintaining static analysis.

Availability and Integration

SkillSpector is freely available on GitHub. The tool can be integrated into development and distribution processes to enhance AI agent security, providing an additional layer of protection against emerging threats.

Implications for AI Agent Security

The introduction of SkillSpector underscores the importance of security in AI applications. AI agents, often used to automate complex tasks, can become attack vectors if not adequately protected. SkillSpector helps mitigate these risks by providing a comprehensive analysis of skills before installation.

Organizations developing or using AI agents can benefit from integrating SkillSpector into their security processes. The tool not only detects known vulnerabilities but also provides mitigation recommendations, improving the overall robustness of AI agents.

Future Directions and Improvements

NVIDIA continues to develop and improve SkillSpector. Future versions may include additional detection patterns, improvements in dynamic analysis, and integrations with other security tools. The open-source community is invited to contribute to the project, sharing feedback and suggestions to enhance AI agent security capabilities.

SkillSpector represents a significant step toward AI agent security. With its comprehensive approach and ease of use, the tool can become an essential resource for developers and system administrators seeking to protect their AI environments from emerging threats.