Installing a skill feels harmless, but underneath that layer is code running with your permissions. NVIDIA recently released SkillSpector: is this skill secure enough to install?
By Anthony Raaijmakers
Installing a skill feels as harmless as adding a browser extension: a few seconds of work, and suddenly your AI assistant can do more. But underneath that handy layer is code that runs with your permissions, can access your files, and sees your API keys. Research among more than 42 thousand skills shows that 26 percent contain at least one vulnerability, and that over 5 percent likely have malicious intent. NVIDIA recently released a tool that wants to answer exactly one question: is this skill secure enough to install?
Skills have grown rapidly in recent months. They are ready-to-use instruction sets, often with included scripts, that give an AI agent like Claude Code, Codex or Gemini CLI extra capabilities. You get them from a marketplace or from GitHub, and they work immediately. The problem is that they run with implicit trust and are barely checked before gaining access to your environment. For a dev team working with this kind of tooling daily, and for the director who wants to know what risk is entering through the backdoor, that is a blind spot worth filling in.
What you see in practice is that the threshold to install a skill is almost zero, while the impact is not. A skill can contain instructions that ask the agent to ignore safety rules, scripts that collect your environment variables and send them outwards, or tools that demand more permissions than they claim to need. The underlying research, "Agent Skills in the Wild" (Liu et al., 2026), found not only that over a quarter of skills are vulnerable, but also that skills with executable scripts are about twice as likely to pose a risk as skills without.
SkillSpector tackles this with a pre-installation scan. You point the tool at a repo, a folder, a zip or a loose SKILL.md file, and it checks 64 patterns divided into sixteen categories: from prompt injection and data exfiltration to permission abuse and poisoning of MCP tools. This happens in two steps. First, a quick static analysis that picks up most signals, then an optional step where a language model assesses context and intent, filtering out false positives. The end result is a risk score from 0 to 100 with clear advice: safe, proceed with caution, or do not install. The output can also be SARIF, so it fits in a CI/CD pipeline and you can enforce it before code enters.
Important to be honest about: such a scan is not a free pass. It is largely static analysis, and that misses things. Non-English texts, attacks hidden in images, and behavior that only becomes visible during runtime are partly outside its scope. A green score therefore does not mean that everything is safe by definition. It is an extra layer of control on top of common sense and review, not the final judgment that makes further vigilance unnecessary.
We look at this primarily through a control lens, not a fear lens. A skill is essentially code that receives your trust, and for everything that runs on your projects and client data, you want to know what's in it and who can access it. That is not a brake on AI, it is exactly the reason to do it right: you decide what runs on your environment, not the marketplace where the skill came from.
This aligns with how we see AI-amplified engineering. AI accelerates work, but the responsibility for what goes live remains with people who understand what they are running. A tool like SkillSpector doesn't replace that judgment, it supports it. It simply makes the control you should be exercising anyway easier and repeatable.
If you or your team are increasingly working with skills, now is the time to add a control step around it instead of installing blindly. Start small: scan the next skill you want to add before it gains access, and then build that into your process.
Would you like to spar about this, or know how to set up skill and agent security in your own workflow? You can give us a call.
Sources: