NVIDIA has released SkillSpector, a free, open-source tool for auditing AI Skills before they are added to agent environments. It scans third-party skill components for hidden instructions and malicious code.
External skills extend what AI agents can do, but each new component adds risk if not checked first. SkillSpector runs locally and analyses code at the component level, flagging suspicious patterns and potentially dangerous operations. No data is sent externally.
The tool matters most for Claude Code, Codex CLI and Gemini CLI, where scripts often execute automatically. Each skill is a potential attack vector. SkillSpector can be integrated into CI/CD pipelines for automated checks when new skills are added.
