When you install a new AI agent Skill, can you trust the files just from the name and description? NVIDIA SkillSpector is a security scanner that reads a Skill's files before installation and looks for risk patterns. It statically analyzes signals that are easy to miss from the text alone, like prompt injection and data exfiltration, and, if you want, also looks at context with an LLM.
You do need to know exactly what "scanned" covers, though. SkillSpector doesn't run the Skill it analyzes, but it isn't a host sandbox that isolates the Skill after installation. Let's start with what analysis runs and where data goes during a scan.
What SkillSpector looks at before installation
It accepts Git repositories and URLs, ZIP files, directories, and single files as input. The default scan combines regex-based pattern detection, Python AST analysis, YARA signature checks, and dependency vulnerability lookups. It checks for several kinds of signals, such as dangerous code calls, prompt injection, privilege escalation, data exfiltration patterns, and known vulnerable dependencies.
It is not dynamic analysis that executes the code of the Skill being scanned. It is static analysis that looks for suspicious traces in a file's contents and structure, so it is best to read the results as clues for your install decision. You can view the report in the terminal or save it in JSON, Markdown, or SARIF format.
Fast pattern checks and optional LLM analysis
Analysis comes in two stages. The first stage, static analysis, quickly checks rules and code structure. The second stage is optional LLM semantic analysis. It is used to review context that is hard to judge from simple patterns alone, such as comparing what a Skill says it will do with what the files actually do.
In the repository's default configuration, LLM analysis is on. In that case, the contents of the files being analyzed are sent to the configured provider endpoint. The repository documents example provider settings for OpenAI, Anthropic, NVIDIA-provided endpoints, Ollama, and others, so check the official README for your environment and the settings you need. If you want to run only static analysis without sending file contents to an external LLM, you can run it like this.
skillspector scan ./my-skill/ --no-llm--no-llm is the option that turns off LLM content analysis. But it doesn't turn off all network lookups. The SC4 supply chain check sends the names and versions of the dependencies a Skill declares to OSV.dev to look up known vulnerabilities. According to the official docs, if it can't connect to OSV.dev, it falls back to a limited built-in list.
How to run it yourself
The official guide has you create a Python virtual environment and then install from the repository. If you can use uv, set it up like this.
git clone https://github.com/NVIDIA/SkillSpector.git
cd SkillSpector
uv venv .venv && source .venv/bin/activate
make installAfter installing, you can scan a local directory, a single SKILL.md, a Git repository, or a ZIP file. For example, to look at a public repository right away, run this.
skillspector scan https://github.com/user/my-skill
skillspector scan ./SKILL.md --format json --output report.jsonThe first command is an example of the default analysis, and the second scans a file and saves a JSON report. When you plug it into CI or a code review flow, you can choose JSON or SARIF output. For environments where the input itself is hard to trust, the README also describes how to run it in Docker. Using a container doesn't mean the scan results isolate the Skill's future execution, though.
Connecting the results to your install decision
The report's risk score and recommendations help you sort out the signals it found quickly. For high scores or high-severity items, check the file and code path yourself, and review whether the permissions the Skill asks for and what it actually does are within the scope you need. Conversely, a low score doesn't mean every attack or runtime behavior was checked. The docs state that SkillSpector centers on static analysis and may miss text inside images, encrypted or binary code, and behavior that only shows up at runtime.
To understand how agent tools run in practice and where permission boundaries sit after installation, how Grok Bot's Primary Bot delegates agent work is also worth a look. For Skill installation and use cases, continue with the introduction to Matt Pocock's Chief of Staff Skill.
To sum up, SkillSpector is a tool that looks for risk signals in an AI agent Skill before installation using static rule checks and optional LLM analysis. The default LLM analysis sends file contents to the configured endpoint, and even with the LLM off, declared dependency coordinates are used for OSV.dev lookups. The key is to use the scan results as one step in your review process and not read them as isolation after installation or a safety guarantee.