NVIDIA Open-Source AI Security Scanner: SkillSpector for Agent Safety

Post Views: 11

SkillSpector is an open-source tool developed by NVIDIA designed to evaluate the safety of AI agent skills before deployment.

SkillSpector: NVIDIA’s open-source security scanner for AI agent skills

SkillSpector is an open-source tool developed by NVIDIA designed to evaluate the safety of AI agent skills before deployment. It analyzes directories, zip files, individual SKILL.md files, or Git repositories to assess potential risks. The system examines all components within a targeted folder, including Markdown instructions and accompanying Python scripts that may interact with system resources such as the shell, environment variables, and SSH configurations. The primary risk vectors often reside in these scripts, as the underlying research indicates that skills containing executable code are 2.12 times more likely to contain vulnerabilities.

Two-Step Analysis Process

The tool employs a two-step analysis process. The first stage is a rapid static analysis that identifies high-risk patterns. It uses an abstract syntax tree (AST) traversal to detect functions like exec, eval, subprocess, and dynamic imports. A taint tracking mechanism monitors the flow of environment variables and file contents to network endpoints. YARA rules are applied to detect known malware, webshells, and cryptominers, while regex-based analyzers address 64 specific detection patterns. These include prompt injection attacks, credential exposure, memory corruption, typosquatted dependencies, and persistence mechanisms via cron jobs.

Dependency Validation and LLM Integration

Certain patterns are unique to the skill format, such as triggers that override built-in commands, homoglyphs in metadata, and hidden characters or HTML comments embedded in tool descriptions. Dependency validation involves querying OSV.dev to check for known vulnerabilities in package lists, with results cached for one hour. In air-gapped environments, a limited internal database is used as a fallback. A second analysis phase, which requires an OpenAI-compatible API endpoint and authentication, leverages a language model to contextualize flagged code, reduce false positives, and generate actionable explanations. This phase achieves approximately 87% accuracy and includes safeguards against jailbreak attempts, as the analysis process itself involves evaluating instructions for a model.

Risk Scoring and Output Formats

Risk scoring is determined by aggregating findings, with critical issues carrying the highest weight. A score exceeding 50 triggers a “do not install” recommendation. Executable content increases the score by 1.3 times, and two high-severity findings in a skill with a Python script automatically trigger the rejection threshold. Output formats include terminal-based reports with line numbers and confidence scores, JSON for automation, Markdown for collaborative reviews, and SARIF for integration into continuous integration pipelines. Disabling the second analysis pass with the –no-llm flag accelerates scans but retains network-based CVE checks via OSV.dev. Offline operation excludes live vulnerability data.

Availability and Impact

SkillSpector is freely available on GitHub, offering a comprehensive solution for evaluating the security of AI agent skills. The tool addresses emerging risks in agentic AI systems by combining static analysis, machine learning, and dependency validation to mitigate threats associated with untrusted code execution.