SkillSpector

// about

Agent skills run with implicit trust. NVIDIA's analysis of 31,132 skills found 26.1% contained vulnerabilities and 5.2% showed likely malicious intent. SkillSpector scans a skill for patterns such as prompt injection and anti-refusal tricks, can add LLM analysis, and runs as an MCP server. It is part of the pipeline that scans, evaluates and signs skills for the NVIDIA skills catalog.

Create a Python virtual environment, then install with uv or pip as described in the README. A Docker image is available if you don't want Python.