# SkillSpector

> Apache NVIDIA scanner for agent skills before you install them

**Category:** AI Agents  
**Pricing:** open-source  
**URL:** https://docs.nvidia.com/skills/scanning-agent-skills  
**GitHub:** https://github.com/NVIDIA/SkillSpector  
**Added:** 2026-09-25

---

## The Hook

SkillSpector is NVIDIA’s security scanner for AI agent skills: check Claude Code / Codex / MCP skills for vulns, prompt injection, exfil, and supply-chain risk before install.

## What's Good

Apache-2.0 (NVIDIA/SkillSpector). Part of the NVIDIA Verified Skills pipeline; docs at docs.nvidia.com/skills. Research-backed framing (high vuln rates in skill corpora). Gate installs in CI or locally instead of trusting a skill README.

## The Catch

Vs Semgrep/Trivy-class general SAST: this is skill/MCP-skill oriented, not a whole-repo AppSec suite. Scanner signal ≠ proof a skill is safe forever — still review permissions and network egress; NVIDIA catalog signing is a separate trust path from running the OSS scanner alone.

## Verdict

Apache skill security gate when your agents install third-party skills — run it before the skill runs you.