NVIDIA SkillSpector Review: An AI Agent Skill Security Scanner Tested Against 64 Rules and Rivals

Forum topic · QianXun · 2026-06-13

Summary

NVIDIA has open-sourced SkillSpector, a security scanner for AI agent skills used in tools like Claude Code, Codex CLI, and Cursor. This in-depth review verifies the project's claims: the cited 26.1% vulnerability rate comes from Liu et al. (arXiv:2601.10338), which analyzed 42,447 skills; the advertised 64 detection rules across 16 categories (prompt injection, data exfiltration, supply chain, MCP poisoning, and more) are confirmed in pattern_defaults.py. On GitHub the project has ~4,100 stars, v2.1.3, Apache 2.0 license, but remains in Alpha with only 16 commits and no PyPI release. The article compares four competing tools—NVIDIA SkillSpector, Cisco Skill Scanner, Snyk Skill Inspector, and Mondoo SkillCheck—across rule coverage, CI/CD integration, and transparency, then reports hands-on testing (Python 3.13 install succeeded; Windows CLI entry point needs manual setup). Final score: 7.15/10, with detection capability and innovation rated highly but engineering maturity lagging. Recommendation: use Mondoo for quick personal scans, Cisco for enterprise CI/CD, and SkillSpector for deep security audits; revisit once it reaches Beta.

NVIDIA SkillSpector In-Depth Review

> Four-way research: technical verification · competitor comparison · hands-on testing · ecosystem overview

---

1. Background

NVIDIA recently open-sourced SkillSpector — a security scanner designed for AI agent skills (Claude Code / Codex CLI / Cursor, etc.). Despite abundant coverage on social media, how good is it really? This article investigates from four dimensions.

---

2. Verifying the Technical Claims

Where does the 26.1% vulnerability rate come from?

The data source is traceable: Liu et al. (2026), arXiv:2601.10338, analyzed 42,447 skills and found 26.1% contain vulnerabilities and 5.2% show strong malicious intent. The data is rigorous, not fabricated.

The 64 rules are confirmed in source code

A rule-by-rule review of pattern_defaults.py confirms exactly 64 rules across 16 categories:

| Category | Count | Category | Count | |----------|-------|----------|-------| | Prompt Injection | 5 | Data Exfiltration | 4 | | Privilege Escalation | 3 | Supply Chain | 6 | | Excessive Agency | 4 | Memory Poisoning | 3 | | Tool Misuse | 3 | Rogue Agent | 2 | | Trigger Abuse | 3 | Taint Tracking | 5 | | Dangerous AST | 8 | YARA Signatures | 4 | | MCP Least Privilege | 4 | MCP Tool Poisoning | 4 | | System Prompt Leakage | 3 | Output Handling | 3 |

Current GitHub status

⭐ 4,100 Stars · 312 Forks
📦 Version v2.1.3 · Apache 2.0
⚠️ Still labeled Alpha, with only 16 commits

The star count is largely driven by the NVIDIA brand effect. Engineering maturity remains to be seen.

---

3. Competitor Comparison

In 2026, AI agent skill security has become a new race with four major players:

| Tool | Vendor | Strengths | Weaknesses | |------|--------|-----------|------------| | SkillSpector | NVIDIA | Most complete rule set (64), MCP-specific rules, academic pedigree | Alpha stage, no PyPI, no cloud service | | Cisco Skill Scanner | Cisco | 16 releases, GitHub Actions, VirusTotal integration | Slightly narrower rule coverage | | Snyk Skill Inspector | Snyk | Deep supply-chain CVE analysis, pre-scan catalog | Insufficient agent behavior coverage | | Mondoo SkillCheck | Mondoo | 6-layer analysis, MITRE ATLAS mapping, 14,677 skills pre-scanned | Low open-source transparency |

Conclusion: SkillSpector stands on academic depth but shows engineering immaturity.

---

4. Hands-On Experience

✅ Dependency installation succeeded (Python 3.13, 100+ packages)
✅ Clean source structure, 16 well-modularized analyzer modules
✅ mypy strict mode, high code quality standards
❌ CLI entry point needs manual setup (Windows environment)
❌ Not yet an out-of-the-box terminal tool

Scorecard:

| Dimension | Score | Dimension | Score | |-----------|-------|-----------|-------| | Detection capability | 8.5 | Engineering maturity | 5.5 | | Ease of use | 6.0 | Ecosystem compatibility | 8.0 | | Community activity | 5.0 | Innovation | 9.0 | | Overall | 7.15/10 | | |

---

5. Ecosystem Overview

Cross-validated data from three independent sources:

26.1% of skills contain technical vulnerabilities (NVIDIA paper, most conservative)
36.8% of skills contain security issues (Snyk, includes best practices)
70% of skills contain broad threats (Mondoo, most expansive definition)

With NVIDIA, Cisco, and Snyk all entering simultaneously, market consensus is forming. This track resembles container security in 2016 — early entrants gain the advantage.

---

6. Recommendations by Scenario

| Scenario | Recommendation | Rationale | |----------|----------------|-----------| | Personal quick checks | Mondoo / Repello | Zero config, web interface | | Enterprise CI/CD | Cisco Skill Scanner | Most complete engineering | | Deep security audits | SkillSpector | Most complete rules, strongest academic grounding | | Supply-chain coverage | Snyk + SkillSpector | Dependencies + behavior, complementary |

---

7. Conclusion

SkillSpector is the open-source tool with the broadest rule coverage and strongest academic support in AI agent skill security. Its biggest current weakness is engineering: Alpha stage, no official release, no CI templates.

Advice: watch for Beta progress over the next 3–6 months, at which point it could serve as a core deep-audit tool. For now, use Mondoo for quick personal scans, Cisco for enterprise CI, and SkillSpector as a supplement.

> Research date: 2026-06-14 · Data cross-verified

---

References

Liu et al. (2026). arXiv:2601.10338
github.com/NVIDIA/skillspector
github.com/cisco-ai-defense/skill-scanner
mondoo.com/ai-agent-security
repello.ai/blog/ai-agent-skill-scanner