SkillSpector: should you install that skill you found on GitHub
Agent skills run with implicit trust, and few people read them before installing. The skill-inspector skill first runs NVIDIA's static SkillSpector scanner, then reads SKILL.md, scripts and MCP manifests itself to check that behaviour matches the description. It ends with one of three verdicts: APPROVE, CAUTION or REJECT.
Runs skillspector scan with --no-llm and pulls the risk score, severity, rule IDs, files and line numbers out of the JSON report.
Re-reads the source around every HIGH or CRITICAL finding and never downgrades one because of the author's reputation or package name.
Looks for token and config reads, data sent off the machine, eval or exec, cron jobs, shell profile hooks and over-broad trigger phrases.
Writes a short triage report in the user's language: verdict, key evidence with file and line, diagnosis and the guardrails for safe use.
When the CLI is missing it says so and falls back to a manual source review, with the verdict marked as lower confidence.
When to use it
Someone shared a skill repository and you want to know whether it touches your keys before you install it.
Your team keeps an internal skill catalogue and needs the same review steps for every new package.
A skill you already use shipped an update and you want to check whether it gained network calls or hidden commands.
Ask your agent
Check the skill at https://github.com/user/my-skill before I install it and give me a verdict
Scan ~/Downloads/pdf-tools with skill-inspector, static analysis only
This skill scored 45 out of 100 for risk; which of its scripts explain that
Questions
How do I install SkillSpector?
Add the skill with npx skills add NVIDIA/SkillSpector@skill-inspector. The scanner itself installs separately, with uv tool install git+https://github.com/NVIDIA/skillspector.git or a Docker image built from the repository.
Does skill-inspector run the scripts of the skill it checks?
No. Its instructions treat the target as untrusted, forbid running its scripts or installers and limit the agent to read-only commands such as find, rg, sed and jq.
What does the SkillSpector scanner detect?
The README lists 71 vulnerability patterns in 17 categories, including prompt injection, data exfiltration, supply chain, memory poisoning and MCP tool poisoning. Reports come as terminal output, JSON, Markdown or SARIF.
