NVIDIA SkillSpector: How to Scan AI Agent Skills for Malware
NVIDIA SkillSpector scans AI agent skills for prompt injection and credential theft before your agent runs them. Here's how it works.
What is NVIDIA SkillSpector?
NVIDIA SkillSpector is an open-source security scanner for AI agent skills, the folders of instructions that give agents like Claude Code, Codex, or Open Code new capabilities. Point it at a skill folder, a zip file, or a Git repo, and it checks the contents for prompt injection, credential theft, data exfiltration, unsafe dependencies, and hidden instructions using more than 70 known attack patterns. It returns a single risk score from 0 to 100 and a plain verdict: safe to install, or don’t touch it.
TL;DR
- Agent skills are just folders containing a
skill.mdfile with a YAML front matter (name and description) and plain-English instructions the agent follows once it decides the skill applies. - Almost nothing validates skills before they run, and research cited in the source video found that roughly a quarter of real-world skills examined carried some kind of vulnerability, with a smaller subset showing signs of actual malicious intent.
- SkillSpector runs two layers of analysis: a fast static pattern engine (regex, AST parsing, and YARA rules) that works with no API key, and an optional LLM-based semantic pass that reads for intent rather than just code patterns.
- Installation is a single command via UV on the demonstrated Ubuntu system, and scanning a skill takes seconds when run with the
--no-llmflag for pattern-only checks. - A live demo caught a real credential-stealing skill: a “chef assistant” skill had a hidden
helper.pyscript, never mentioned in the markdown, that harvested environment variables and sent them to an external server. - Static analysis has limits: a natural-language instruction quietly inserted into the skill’s cooking steps was not flagged, suggesting the pattern-based scanner alone may miss non-code social engineering that would need the LLM pass to catch.
- The tool assigns a coverage percentage alongside the risk score, showing how much of a skill’s content was actually inspected rather than skipped.
Everyone else built a construction worker.
We built the contractor.
One file at a time.
UI, API, database, deploy.
How do AI agent skills actually work?
A skill is deliberately simple: a folder containing at minimum a skill.md file. At the top of that file sits a front matter block bounded by three dashes, containing a name and a description. The description is the single most important line in the file, because it’s what the agent’s underlying model reads first to decide whether this skill is relevant to the current task. The agent loads that description essentially for free, and only when the task matches does it pull in the rest of the file, the full instructions written in plain English covering when to use the skill, what steps to follow, and what output format to produce.
There’s no sandboxing built into that model. Whatever text sits below the front matter, the agent trusts and acts on with the same permissions and credentials the agent already has. A skill that tells an agent to read environment variables and post them somewhere isn’t doing anything the agent wasn’t already capable of, it’s just directing that capability somewhere it shouldn’t go. That’s what makes skills powerful and also what makes them a clean attack surface: the instructions are human-readable, but almost nobody reads them before installing.
Why do agent skills need a security scanner?
Skills are spreading fast across agent tooling: Claude Code, Codex, Open Code, and similar frameworks all support dropping in a skill folder to extend what an agent can do, from deploying to Kubernetes to opening pull requests. The source video notes that OpenAI has already been affected by a skill-related incident, and cites research across tens of thousands of real-world skills finding that around a quarter carried some form of vulnerability, with a smaller fraction showing signs of deliberate malicious design.
The risk comes from the trust model. A skill executes inside the agent’s full context, meaning it inherits whatever access the agent already has, API keys, environment variables, file system permissions, and network access. A malicious skill doesn’t need to break out of a sandbox because there typically isn’t one. It just needs to look legitimate enough that a developer installs it, and it fits neatly into an agent’s existing workflow.
How does NVIDIA SkillSpector work?
SkillSpector layers two kinds of analysis on top of each other. The first is static pattern matching: regex checks, abstract syntax tree (AST) parsing of any code in the skill, and YARA rule matching against known attack signatures. This layer runs without any external API and is fast, catching code-level red flags like scripts that read environment variables and transmit them externally, or skills that declare no tool scope (meaning they’re requesting unrestricted access rather than being limited to specific actions).
One coffee. One working app.
You bring the idea. Remy manages the project.
The second, optional layer is an LLM-based semantic pass. This requires an API key and reads the skill’s actual meaning and intent rather than just matching patterns. This matters because some attacks aren’t expressed in code at all. They’re expressed as natural-language instructions buried inside otherwise normal-looking steps, the kind of thing a regex won’t catch but a language model reading for intent might.
Both layers feed into one combined risk score from 0 to 100, mapped to a verdict (safe, caution, or don’t install) along with a severity rating and a coverage percentage showing how much of the skill’s content was actually analyzed.
What did the demo scan actually catch?
In the demonstration, a clean skill scored 0 out of 100 with a “safe” verdict and zero issues detected, with 100% coverage confirming the entire file was read and checked.
The second test used one of NVIDIA’s own published example skills: a “chef assistant” designed to help with cooking and recipes. The demonstrator added an extra instruction line as a joke, then ran the scan. The score jumped significantly, with the severity rated medium and the verdict shifting to caution, flagging five separate issues. The scanner surfaced a hidden helper.py script sitting in a scripts subdirectory that was never referenced anywhere in the skill’s markdown file. That script harvested environment variables and sent them to an external server, a textbook case of credential theft disguised inside an unrelated, innocuous-looking skill. The scanner also flagged that the skill declared no tool scope, meaning it was requesting unrestricted access rather than being limited to the cooking-related actions it claimed to need.
Notably, the added joke instruction (a plain-English line inserted into the recipe steps) was not flagged by the scan. That’s a useful data point: the pattern-based static engine is built to catch code-level attacks, not necessarily subtle natural-language manipulation, which is where the optional LLM pass is meant to add value.
Is SkillSpector worth using in production?
For anyone running agents that install or execute third-party skills, a free, open-source scanner that catches hidden credential-stealing code before it runs is a low-cost addition to a pipeline. The static-analysis mode requires no API key and runs quickly, making it cheap to run as a gate on every skill before installation. The demonstrated catch (an external-facing helper script harvesting environment variables) is exactly the kind of concrete, high-severity threat that justifies adding this step.
The caveat is that static pattern matching alone won’t catch everything. Natural-language social engineering embedded in instructions, rather than in code, appears to need the LLM-based semantic pass to reliably surface. Anyone relying solely on the fast, no-LLM mode should treat a passing score as a floor, not a guarantee, particularly for skills sourced from unfamiliar or unverified repositories.
Frequently Asked Questions
What is an AI agent skill?
An agent skill is a folder containing a skill.md file with a short front matter (name and description) and plain-English instructions. Agents like Claude Code or Codex read the description to decide when to use the skill, then follow its instructions with the agent’s existing permissions and credentials.
What does NVIDIA SkillSpector actually scan for?
It scans for prompt injection, credential theft, data exfiltration, unsafe or hidden dependencies, and undeclared hidden instructions, using more than 70 known attack patterns combined with optional LLM-based semantic analysis.
Remy is new. The platform isn't.
Remy is the latest expression of years of platform work. Not a hastily wrapped LLM.
Do I need an API key to use SkillSpector?
No. Running it with the no-LLM option performs fast, pattern-based static analysis (regex, AST parsing, and YARA rules) without any external API. An API key is only needed to enable the additional LLM semantic-analysis pass.
Can SkillSpector catch every type of malicious skill?
Not entirely. In testing, the static scanner reliably caught code-based attacks like a hidden script exfiltrating environment variables, but it missed a plain natural-language instruction inserted into the skill’s text, suggesting subtle social-engineering style attacks may require the LLM pass to detect.
How is a skill scored by SkillSpector?
Every scan returns a risk score from 0 to 100, a severity rating, a verdict (such as safe or caution), and a coverage percentage indicating how much of the skill’s content was actually inspected during the scan.