Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks.
Market Signal
Why It Has Market Pull
NVIDIA's open-source scanner for AI agent skills inspects a skill for prompt injection, data exfiltration, and supply-chain risk before you install it, and it has caught on fast: roughly 5,000 GitHub stars within weeks of its May 2026 release and integration into OpenClaw's skill-review pipeline. For any team that installs third-party agent skills, it is an unusually credible early entrant worth a closer look.
- ~5,000 GitHub stars and 383 forks within weeks of the May 22, 2026 release; reached GitHub trending
- Detects 64 vulnerability patterns across 16 categories (prompt injection, data exfiltration, tool poisoning, supply-chain risk) via hybrid static plus LLM analysis
- Already wired into OpenClaw's ClawHub publishing flow as an advisory security check
- Backed by the NVIDIA organization; Apache-2.0 licensed, with terminal, JSON, Markdown, and SARIF output and Docker deployment
- Grounded in NVIDIA's study of 42,447 real agent skills, which found 26% contained a vulnerability and 5% showed likely malicious intent
feedbacks
What People Are Saying
"A good security plan needs multiple layers, this seems like a good one to include."HN comment
"Skills are ultimately just prompts, and agents execute code based on what is in them."HN comment
"Skills can include python files that do whatever in subfolders."HN comment
"LLM reviewing LLM? If the review model catches it, the executing model would refuse to run it."HN comment
"It combines static checks with AI-assisted semantic analysis to flag risks malware scanners miss."Dev.to article
"It might be better than nothing, but it is hard to know how much better."HN comment
"26% of AI agent skills are dangerous, and SkillSpector by NVIDIA is the fix."YouTube post


















