用于AI代理技能的安全扫描器。 在安装代理技能前，先检测漏洞、恶意模式和安全风险。

概述

AI代理技能（由Claude Code、Codex CLI、Gemini CLI等使用）以隐性信任和最小化审核执行。在分析的31,132项技能研究数据集中，26.1%的技能存在漏洞，5.2%显示可能有恶意意图。

SkillSpector帮你回答：“这个技能安装安全吗？”**

SkillSpector 是 NVIDIA 验证技能流程的一部分，该流程在发布前扫描、评估并签署代理技能。通过的技能会发布到 NVIDIA 技能目录。

文献资料

• 安装前扫描代理技能 — 托管指南：何时扫描、如何阅读报告及如何进行安装门控。
• 开发指南 — 架构、封装布局及分析仪流水线扩展方法。
• 分析资源界限 — 失败闭合捆、解析器、嵌套工件、账本和寻找上限。
• Pi 扩展 — 安装 SkillSpector 作为 Pi 工具，用于扫描代理会话内部的技能。

SkillSpector

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills.

Overview

AI agent skills (used by Claude Code, Codex CLI, Gemini CLI, etc.) execute with implicit trust and minimal vetting. In the 31,132-skill analyzed subset of the research dataset, 26.1% of skills contain vulnerabilities and 5.2% show likely malicious intent.

SkillSpector helps you answer: “Is this skill safe to install?”

SkillSpector is part of the NVIDIA Verified Skills pipeline, which scans, evaluates, and signs agent skills before publication. Skills that pass are published to the NVIDIA skills catalog.

Documentation

• Scan agent skills before installation — Hosted guide: when to scan, how to read a report, and how to gate installs.
• Development guide — Architecture, package layout, and how to extend the analyzer pipeline.
• Analysis resource bounds — Fail-closed bundle, parser, nested-artifact, ledger, and finding ceilings.
• Pi extension — Install SkillSpector as a Pi tool for scanning skills from inside agent sessions.
• OpenCode extension — Install SkillSpector as an OpenCode tool and /skillspector command for scanning skills from inside agent sessions.

Features

• Multi-format input: Scan Git repos, URLs, zip files, directories, or single files
• 71 vulnerability patterns across 17 categories: prompt injection, data exfiltration, privilege escalation, supply chain, excessive agency, output handling, system prompt leakage, memory poisoning, tool misuse, rogue agent, anti-refusal, trigger abuse, dangerous code (AST), taint tracking, YARA signatures, MCP least privilege, and MCP tool poisoning
• Two-stage analysis: Fast static analysis + optional LLM semantic evaluation
• Live vulnerability lookups: SC4 queries OSV.dev for real-time CVE data with automatic offline fallback
• Multiple output formats: Terminal, JSON, Markdown, and SARIF reports
• Risk scoring: 0-100 score with severity labels and clear recommendations
• Baseline / false-positive suppression: Accept known findings via a glob-rule or fingerprint baseline so re-scans surface only new issues (docs)

Quick Start

Installation

Open-source software notice: This project will download and install additional third-party open source software projects. Review the license terms of these open source projects before use.