Agent skills are ZIP files with instructions and scripts that your coding agent executes with implicit trust. That is a supply-chain surface. Of course scanners showed up.
NVIDIA SkillSpector is the tool AlphaSignal highlighted in June 2026: open source, Apache 2.0, integrated into NVIDIA's Verified Skills pipeline. It scans repos, directories, zips, or URLs before you install a skill into Cursor, Codex, or an MCP host.
The uncomfortable part, which the same news cycle buried in research papers: static scanners are necessary and insufficient. If your security model ends at install-time regex, you are one obfuscation trick away from a bad day.
What SkillSpector actually does
SkillSpector is a hybrid scanner:
| Stage | Coverage |
|---|---|
| Static rules | 70 patterns across 17 categories |
| Bytecode checks | Python .pyc integrity |
| Taint / dataflow | Shell pipelines and Python AST paths |
| Optional LLM pass | Semantic review of SKILL.md and scripts |
| Live CVE lookup | OSV.dev queries with offline fallback |
| Outputs | Terminal, JSON, Markdown, SARIF |
Categories include prompt injection, credential exfiltration, privilege escalation, memory poisoning, rogue agent behaviors, MCP least-privilege violations, and tool misuse.
It also supports baseline suppression: fingerprint known findings so re-scans surface only new issues. That is ops-friendly when you audit the same monorepo weekly.
NVIDIA positions SkillSpector inside a broader skills program (docs here). For solo developers, the practical win is a single CLI that speaks the Agent Skills formats for Codex and Cursor, plus MCP bundles.
Cisco AI Defense skill-scanner is the other mature open-source option in this space, combining YARA/YAML signatures, behavioral dataflow, and optional cloud LLM analysis. I keep both installed. They overlap, but signature coverage differs.
The SkillCloak problem
June 2026 security coverage converged on the same paper family: Cloak and Detonate from HKUST researchers.
Their SkillCloak tool demonstrates two evasion paths:
- Token rewriting that reassembles malicious commands at runtime
- Self-extracting packs that hide payloads in directories scanners skip (like
.git/), then rebuild the skill when the agent executes a decoder
Help Net Security summarized the results: packing beat every scanner more than 90% of the time in their tests. Simple rewrites still fooled over 80% of static tools.
That is not a SkillSpector dunk. It is an industry dunk. Adversa.ai ran eight open-source scanners against real attack variants in 2026 and reported a malicious skill evading all eight, including encoding tricks, homoglyphs, paraphrased prompt injections, and skills that instruct the LLM judge to flip verdicts.
If you run agent skills in production, read that sentence twice.
Scan first, sandbox second
The same HKUST line of work proposes SkillDetonate: run the skill in a sandbox and watch OS-level behavior (reads, writes, network) instead of trusting file contents.
Trade-off table:
| Approach | Latency | Evasion resistance | Ops fit |
|---|---|---|---|
| Static scan (SkillSpector, Cisco) | Seconds | Low against packing/obfuscation | Great pre-install gate |
| LLM-as-judge | Seconds to minutes | Low if judge reads attacker text | Useful, not sufficient alone |
| Sandbox behavioral trace | Minutes | High (87% on real malicious skills in paper) | Best before org-wide rollout |
My client rule after twelve million exposed env files and browse-capable agent prompt injection:
- Pin skills to commit hashes you reviewed
- Scan with at least one static tool (SkillSpector or Cisco)
- Run new skills in a disposable environment before they touch prod repos
- Never give a skill broad secrets without a vault boundary (agent secrets vault pattern)
What good hygiene looks like in Cursor and Codex
Skills are not npm in 2014. They are closer to unsigned browser extensions with shell access.
Practical checklist:
- Read
SKILL.mdyourself, especially shell snippets andcurl | bashpatterns - Run SkillSpector with JSON output in CI for third-party skills
- Reject skills that download payloads at runtime without pinned hashes
- Separate dev agent credentials from prod deploy credentials
- Log tool calls when testing a new skill bundle
NVIDIA's stats (26.1% vulnerable, 5.2% likely malicious) are directional, not your org's risk score. They do justify default-deny for random GitHub skills with hype READMEs.
How this ties to the skills gold rush
AlphaSignal also mentioned giant prompt libraries hitting huge GitHub star counts. Stars are not audits. A popular repo with 140 prompt templates is still unvetted executable policy once an agent loads it.
The macro trend: skills compress expertise into portable folders. That is great for velocity and terrifying for security teams who just learned what MCP is last quarter.
SkillSpector is the right response as layer one. Treat it like npm audit, not like a guarantee.
Bottom line
Install SkillSpector (or Cisco skill-scanner) before you install random agent skills from social feeds. Let it catch obvious injection, exfiltration, and MCP misconfigurations.
Then assume a motivated attacker can bypass static checks. Sandbox. Pin versions. Keep secrets out of the agent's default environment.
If you are rolling out agent skills across a team and want a review workflow that survives real attackers, book a free discovery call.