🚨 NVIDIA JUST OPEN-SOURCED ONE OF THE MOST IMPORTANT AI UTILITIES OF THE YEAR
Right now, developers are downloading third-party "skills" straight off GitHub for their AI agents.
But an AI skill is not just a text prompt. It’s executable code that runs with your system privileges.
A skill you grab to save ten minutes can read your environment variables, lift your API keys, and quietly send them to an external server.
Recent research shows 26.1% of public skills carry vulnerabilities, and over 5% are outright malicious.
NVIDIA’s new release, SkillSpector, closes this gap.
It’s an Apache 2.0 licensed security scanner that answers one question: is this skill safe to run?
Here is how the pipeline works:
→ You point it at a GitHub link, local folder, or a single SKILL.md file.
→ Pass 1: A fast static scan flags credential harvesting, prompt injections, and checks live CVE data.
→ Pass 2: An optional LLM pass evaluates the semantic intent of the code to clear out false positives.
At the end, you get a 0 to 100 risk score and a clear verdict: Safe, Caution, or Do Not Install.
It currently scans skills for Claude Code, Codex CLI, and Gemini.
Worth running before you blindly trust the next agent skill you find online.
repo link in 🧵↓