What Is NVIDIA SkillSpector? Skill Security Scanner: Setup, Commands, Risk Score, License and Data

AI agents (such as Claude Code, Codex and Gemini CLI) use packages called skills: an instruction file and often scripts. The README says these skills run “with implicit trust and minimal vetting” and, citing a research dataset, reports that of 31,132 skills examined, 26.1% contained security vulnerabilities and 5.2% showed likely malicious intent (the README's own research citation). SkillSpector asks exactly this: “Is this skill safe to install?” The skill is scanned before installation and is never executed.

Who it helps: developers who download agent skills or MCP servers from the internet; people who want to check their own skill before publishing it; teams auditing an internal skill catalog. SkillSpector is part of NVIDIA's “Verified Skills” pipeline; the NVIDIA documentation also says it is the first layer of SkillEvaluator, the pre-release evaluation tool.

• Python: 3.12, 3.13 or 3.14 (package spec >=3.12,<3.15).
• Version: 2.12.0 according to pyproject; the latest release tag on GitHub is v2.12.0, September 23, 2026. The package classifier says “Alpha”.
• PyPI: pip install skillspector does not work; there is no package with this name on PyPI (as of October 15, 2026). Install from GitHub.
• Hardware: no official minimum RAM/CPU; no GPU needed. If you use a local model (Ollama), its requirements apply.

!The README warns that installation will also download and install third-party open-source software; review their licenses before use.

The score is computed from the weight of the findings: critical +50, high +25, medium +10, low +5; ×1.3 if there is an executable script. The exit code is a fixed contract for CI: 0 the scan finished and the score is 50 or lower; 1 the score is above 50 or one of the strict gates you chose (--fail-on-findings, --fail-on-incomplete, --min-coverage) was triggered; 2 error (bad input, unreadable source). By default both SAFE and CAUTION return 0; for a strict gate, use these flags or the recommendation field in the JSON.

The MCP server exposes a single tool: scan_skill. The “initialize” hang over the stdio transport noted in the README (issue #199) still applies; the HTTP transport runs without authentication and only on a local (loopback) address. For remote access, you need to put an authenticating proxy in front of it.

SkillSpector works in two stages: first fast, deterministic static checks (pattern matching, Python AST, YARA); then an optional AI model compares what the skill says with what it does (semantic analysis). According to the README, LLM analysis is on by default; turn it off with --no-llm.

Each provider's default model is listed in the README and changes often; override it with SKILLSPECTOR_MODEL. The codex_cli provider is disabled because its read-only sandbox allows reading host files. The commands are for bash; the Windows PowerShell equivalent is $env:NAME = "value".

Cost: the software is free. Money can only go to the LLM provider you choose (per token if it's in the cloud); with --no-llm there is no cost at all. No account or sign-up is needed for the tool (apart from the LLM provider's own key). Updates are up to you: uv tool update skillspector.

The license summary is taken from the Apache License 2.0 text and is not legal advice. The scanned skills' own licenses also apply.

The score in the report is not a guarantee: SAFE means “the scanner found nothing”. If selected files were excluded or the analysis was incomplete, coverage counts as “partial” and SAFE is not given; for a strict gate, use --fail-on-incomplete. For false positives there is a baseline (accepting known findings).

The pattern count varies by source: the GitHub README says 71 patterns in 17 categories, the NVIDIA documentation page says 68 patterns. The tool is classified as “Alpha” and updated often (v2.11.0 on August 28, v2.12.0 on September 23, 2026); the rule set changes from version to version.