SkillSpector — Vendor-Backed Security Scanner for AI Agent Skills, Well-Scoped but Dependent on Static Patterns

What It Is

SkillSpector is a security scanner that analyzes AI agent skills (code/configuration bundles used by Claude, Codex, Gemini, etc.) to detect vulnerabilities before installation. It runs static analysis + optional LLM semantic checks, outputs findings in multiple formats (terminal, JSON, Markdown, SARIF), and assigns a 0–100 risk score.

Who It's For

• 
  Agent developers wanting to audit skills before publishing
  


• 
  Platform operators (Anthropic, Google, etc.) vetting community skills at scale
  


• 
  Security teams integrating agent scanning into CI/CD workflows
  


• 
  Enterprise users installing third-party agents and needing confidence scores

What's Genuinely Good

1. Concrete problem statement backed by data — README cites "26.1% of skills contain vulnerabilities, 5.2% show malicious intent." This frames urgency clearly, even if no link is provided.




2. 64 patterns across 16 well-defined categories — Prompt injection, data exfiltration, supply chain, excessive agency, memory poisoning, rogue agents, etc. The taxonomy is thoughtful and covers the agent-specific threat model (not just generic code scanning).




3. Live CVE lookups (SC4) — Queries OSV.dev for real-time vulnerability data with offline fallback. This is non-trivial and keeps dependency checks current.




4. Multi-input flexibility — Scans Git repos, URLs, zip files, directories, single files. Removes friction for users.




5. LLM-optional, multi-provider — Works with OpenAI, Anthropic, NVIDIA inference, or local Ollama. Lets users pick cost/latency tradeoffs; --no-llm enables fast static-only mode.




6. Production-grade outputs — SARIF format for IDE/CI integration is valuable; Markdown for documentation, JSON for tooling.

One Honest Trade-Off

Pattern library is static and cannot adapt to novel attack families. The README lists 64 patterns but does not explain how they are maintained, extended, or validated against real-world agent exploits. There is no mention of:

• How patterns are sourced (threat research? fuzzing? incident response?)
  


• Whether this list is frozen or evolving
  


• How false positives are managed
  


• Whether the LLM stage (semantic analysis) is necessary to catch evasion, or if static patterns alone suffice for the claimed 26.1% detection rate

If threat actors discover pattern-evasion techniques (e.g., obfuscation, semantic-equivalent rewrites), SkillSpector may silently miss them unless patterns are rapidly updated. The README does not make this clear.

Verdict

A well-architected, vendor-backed tool that solves a real problem with sensible design (pattern taxonomy, live CVE lookup, multi-format output, optional LLM). Trustworthy for adoption in agent platforms and enterprise workflows, but success hinges on continuous pattern maintenance—a detail the README glosses over.

REPO: NVIDIA/SkillSpector


License: Apache 2.0


Stars: 2552 | Maturity: Early (created Mar 2026, last push Jun 2026)

🔗 Repo:

An honest review by the Flowork team — we read the README so you don't have to. We build open-source tooling too; this isn't a sponsored post.