NVIDIA Releases SkillSpector to Secure AI Agent Skills
NVIDIA has launched SkillSpector, an open-source security scanner designed to identify risks in AI agent skills before they are deployed.
NVIDIA has introduced SkillSpector, a new open-source security scanner aimed at bolstering the safety of AI agent skills. These skills, which can encompass Markdown instructions and Python scripts, are crucial for extending the capabilities of AI agents but also present a significant attack surface. SkillSpector analyzes these skills to identify potential risks, providing users with a risk score and actionable recommendations to help them make informed decisions about whether to install a given skill.
The tool is designed to be versatile, accepting input from directories, zip files, individual SKILL.md files, or Git URLs. Upon analysis, it generates a list of findings, a comprehensive risk score, and specific recommendations. The research underpinning SkillSpector revealed that skills shipping with Python scripts are 2.12 times more likely to be vulnerable, as AI agents often load these skills based on trust without thorough vetting.
SkillSpector employs a multi-stage analysis process. The initial static pass, which takes only seconds, involves an Abstract Syntax Tree (AST) walk to flag potentially dangerous functions like exec, eval, subprocess, and dynamic imports. It also utilizes a taint tracker to monitor environment variables and file contents flowing to network sinks. Furthermore, YARA rules are employed to detect known malware, webshells, and cryptominers.
Complementing these methods, regex analyzers handle the remaining 64 detection patterns. These patterns are designed to identify a wide array of threats, including prompt injection, credential access attempts, memory poisoning, typosquatted dependencies, and persistence mechanisms like cron jobs. Specific checks are in place for prompt-based risks, such as trigger shadowing of built-in commands or malicious directives hidden within tool metadata using homoglyphs or right-to-left overrides.
Dependency checking is integrated by querying OSV.dev for known CVEs associated with a skill's package list. This query is batched for efficiency and the results are cached for an hour. For air-gapped environments, SkillSpector falls back to a smaller, built-in list of known vulnerabilities.
An optional, slower second pass leverages a large language model (LLM) for deeper analysis. When configured with an OpenAI-compatible endpoint and API key, the LLM can review flagged code in context, helping to reduce false positives and provide human-readable explanations. This LLM analysis is prompted with anti-jailbreak instructions, acknowledging that the skill itself is a set of instructions for another model.
The risk score is calculated based on the severity of each finding, with critical findings contributing more points. Any skill scoring above 50 on the scale is flagged with a "do not install" recommendation. The presence of executable content, such as Python scripts, further multiplies the risk score, meaning a skill with just a couple of high-severity findings in a script could automatically cross the "do not install" threshold.
SkillSpector provides output in multiple formats to suit different workflows, including human-readable terminal output, JSON for scripting, Markdown for review threads, and SARIF for integration into CI/CD pipelines. The tool is freely available on GitHub, empowering developers and security teams to proactively secure their AI agent ecosystems.