Free security tool

Scan a skill
for what it will actually do

A security verdict and nothing else. SkillSpector reads the instructions for prompt injection, credential access, data exfiltration, and supply-chain risk.

  • Never executed
  • NVIDIA SkillSpector scan
  • Nothing stored
01

The skill

What are we scanning?

NVIDIA SkillSpector · static and AI passes · nothing is stored

Read the instructions before your agent follows them

Free security-only scan of an agent skill: NVIDIA SkillSpector reads the instructions for prompt injection, credential access, data exfiltration, and supply-chain risk, and nothing is executed or stored.

Why it matters

Installing an agent skill is closer to running a script than to reading a document. The folder is a set of instructions an agent loads and then acts on, and an agent that trusts the folder will read the files it names, call the URLs it lists, and run the commands it spells out. The dangerous part of a skill is rarely hidden. It is written in plain English in the middle of otherwise reasonable setup steps, which is exactly where a human skim stops paying attention.

The Skill Evaluator answers a different question: is this skill any good. This tool drops the quality half and returns a security verdict alone, because the decision before you install something is not whether it is well written. A polished, well-documented skill with a line telling the agent to read your SSH key is a better-hidden problem than a sloppy one, and a quality score would make it look better rather than worse.

What the tool does

Three ways in. Paste SKILL.md contents, give a public HTTPS or GitHub URL, or upload a SKILL.md or a .zip bundle up to 2 MB. A GitHub folder URL is pulled as a bounded archive up to 10 MB, capped at 100 files and 5 MB expanded. Remote fetches are HTTPS only, refuse credentials in the URL, reject any hostname that resolves to a private network, pin the connection to the address that was checked, and revalidate every redirect. Everything is read as text in a temporary directory. Nothing is installed, nothing lands in a workspace, and no instruction inside the skill is carried out.

Two passes run over the content. SkillSpector's static analyzers match known risky patterns, and its LLM analyzers judge intent, which is what catches an instruction that is dangerous in context but matches no pattern. The model pass needs a reachable provider, so when one is not available the scan falls back to static alone and the result says which pass produced it rather than quietly claiming both. You get a security score out of 100, a verdict, a count by severity, and every finding with its file, line, the matching excerpt, confidence, and a suggested fix. Nothing is saved: no fingerprint, no cached result, no shareable page. Run it again and it scans again.

Terms worth knowing

SkillSpector
NVIDIA's open analyzer for agent skills. It reads a skill's files and reports each risky construct with a rule id, a severity, a location, and a confidence.
Security score
100 minus the risk score. A skill with no findings scores 100; findings subtract from it in proportion to severity and confidence.
Verdict
The three-way call printed beside the score: Safe to try, Use with caution, or Do not install. It follows the risk bands, where 51 and above is do not install and 21 to 50 is caution.
Prompt injection
Text inside the skill aimed at the agent's instruction hierarchy rather than at the task, typically an override such as ignoring earlier rules or a fake system message.
Data exfiltration
An instruction that sends files, secrets, or conversation content outward: a POST to a collector, an upload, a webhook, a paste to a service the task never needed.
Supply-chain risk
Setup steps that fetch and run code from somewhere else, most often a pipe-to-shell install or a dependency pulled from an unpinned source.
Static and LLM passes
Pattern matching finds known shapes; model analysis reads for intent. The report names the mode it ran in, so a static-only result is never presented as a full one.

Frequently asked questions

Short answers for the decisions that usually come up after a first run.

Is the skill installed or executed?

No. Files are read as text into a temporary directory and analyzed there. No ZIP is extracted into a workspace, no script inside the skill is run, and no instruction it contains is carried out. The scan treats the skill as untrusted input from the first byte.

How is this different from the Skill Evaluator?

The Evaluator returns a quality rubric plus a security scan, caches the result against a content fingerprint, and gives you a permanent result page and a README badge. This tool runs the security half alone and stores nothing. Use it when the only question is whether the skill is safe to install; use the Evaluator when you also want to know whether it is worth installing.

What does the security score mean?

It is 100 minus the risk score. Each finding contributes according to its severity, critical 50, high 25, medium 10 and low 5, scaled by the confidence the analyzer reports, with extra weight when the finding sits in an executable file. Repeated hits on the same rule count less each time, so three instances of one pattern do not outweigh three distinct problems. A risk score of 51 or more reads Do not install, 21 to 50 reads Use with caution, and below that reads Safe to try.

Does a clean scan mean the skill is safe?

No, and the result page says so. A scan is a triage signal, not a security certification. It reads the text in front of it; it cannot follow a script the skill downloads at runtime, judge a URL it has never seen, or know what the author intends. Read anything you did not write, and sandbox it the first time you run it.

What does it actually look for?

Four families. Prompt injection, meaning instruction overrides and attacks on the agent's instruction hierarchy. Credential access, meaning SSH keys, cloud credential files, and token stores. Data exfiltration, meaning outbound sends of files or secrets. Supply chain, meaning pipe-to-shell installs and unpinned sources. Every finding names the file and line so you can go read the line yourself.

Is my skill stored, logged, or used for training?

No. The content lives in a temporary directory for the length of the scan and is discarded with it. There is no cache, no fingerprint, and no saved result, which is the trade-off for the Evaluator's shareable page: you cannot link to a scan afterwards because there is nothing to link to.

Can I scan a repository with several skills in it?

Yes. Point it at the GitHub URL. When the archive contains more than one SKILL.md, each skill is scored on its own and the verdict reports the riskiest one rather than adding their findings together, so a large collection of safe skills is not condemned by arithmetic. The result shows how many skills were found and how many files were read.

How many scans can I run?

Three every 30 minutes without an account, ten on a paid plan while signed in. Each scan forks the analyzer, so the endpoint stays public but bounded, and the address behind a request is kept only as a hash. A scan with model analysis can take up to four minutes on a large bundle; the static pass is much faster.