AI coding agents are moving from autocomplete to delegated work. The next step is the skill layer: portable instruction packs that tell an agent how to use a library, call a tool, follow a workflow, or complete a specialist task.
That is useful, but it changes the security model. A skill is not only documentation. It can contain instructions, scripts, dependencies, tool descriptions, and assumptions about what the agent is allowed to do. Once installed, it may influence how the agent reads code, touches files, calls APIs, handles secrets, or speaks to external systems.
NVIDIA SkillSpector is an open-source scanner built for this new layer. It scans AI agent skills before installation or publication, looking for conventional software risks as well as agent-specific problems such as prompt injection, hidden instructions, excessive agency, data exfiltration, and MCP tool poisoning.
The Short Answer
NVIDIA SkillSpector helps answer a simple question: should this AI agent skill be installed?
It accepts Git repositories, URLs, zip files, local directories, and single files. By default, it runs fast static checks. It can also add optional LLM-based semantic analysis for issues that require comparing what a skill claims to do with what its instructions or supporting files actually enable.
The scanner reports findings in terminal, JSON, Markdown, and SARIF formats, which makes it usable both by individual developers and in CI pipelines. NVIDIA's documentation lists checks for prompt injection, data exfiltration, privilege escalation, supply-chain issues, excessive agency, output handling, system prompt leakage, memory poisoning, tool misuse, rogue-agent behaviour, trigger abuse, dangerous code patterns, taint tracking, YARA signatures, MCP least privilege, and MCP tool poisoning.
SkillSpector also supports live dependency vulnerability lookup through OSV.dev, with an offline fallback when network access is unavailable. That matters because agent skills can combine natural-language instructions with ordinary software supply-chain risk.
Why Agent Skills Need Their Own Review
Traditional application security review focuses on source code, dependencies, infrastructure, identity, and data flows. Agent skills add a different kind of attack surface: instructions that are interpreted by a model and then acted on through tools.
A malicious or careless skill does not always need an obvious exploit. It might tell the agent to ignore previous constraints, send context to an external URL, enumerate local files, harvest environment variables, fetch a remote script, or use an MCP tool in a way the user did not expect. It can also understate what it does, which makes a manual review harder if reviewers only read the description.
This is why agent skill security sits between software supply-chain security and AI governance. The artifact may include code, but it can also include behaviour-shaping language. It may never execute as a standalone binary, yet it can still influence an agent that has access to repositories, tickets, customer records, cloud consoles, or internal documentation.
The risk applies across company sizes. A startup may install a skill directly into a developer workstation that already has source code and API credentials nearby. A larger organisation may distribute an internal skill across many engineering teams and accidentally standardise unsafe behaviour. In Singapore, where startups and SMEs are adopting AI coding assistants quickly, the same basic concern applies: customer data, PDPA obligations, vendor due diligence, and enterprise procurement expectations do not disappear because the tool is new.
How SkillSpector Works
SkillSpector is designed to scan before trust is granted. That is the right placement. Once a skill is installed and used in real workflows, the agent may already have acted on unsafe instructions.
The first layer is static analysis. SkillSpector inspects files in the skill package for known risky patterns. These include direct instruction override, hidden directives, suspicious external transmission, environment variable harvesting, dangerous shell execution, unpinned dependencies, obfuscated code, credential access, broad tool permissions, and unsafe MCP metadata.
The second layer is optional semantic analysis. Some issues are not obvious from a single string or code pattern. A skill may claim to generate documentation while also requesting broad file-system access or network calls. A semantic pass can help compare stated purpose against actual behaviour, which is useful for catching excessive agency and scope creep. It should reduce blind spots, but it should not be treated as a final safety verdict.
The third layer is reporting. Local developers can use terminal or Markdown output while reviewing a skill. Security teams can use JSON for automation. SARIF output is especially useful because it can feed code scanning systems and CI gates.
Typical commands look like this:
skillspector scan ./my-skill/
skillspector scan ./my-skill/ --format markdown --output skillspector-report.md
skillspector scan ./my-skill/ --format sarif --output skillspector.sarif
The practical goal is not to produce a report for its own sake. The goal is to decide whether a skill should be blocked, fixed, sandboxed, signed, or accepted with documented risk.
What It Will Not Solve By Itself
SkillSpector is a useful control, but it is not a full AI agent security programme.
It cannot decide whether a skill is appropriate for your business context. It cannot tell whether an agent should be allowed to touch a production repository, customer data set, Slack workspace, email account, cloud project, or finance system. It also cannot replace runtime controls such as sandboxing, secrets isolation, network restrictions, approval prompts, logging, and least-privilege MCP configuration.
There is a similar point around signing. NVIDIA's verified agent skills flow uses scanning, skill cards, review, signing, cataloguing, and synchronization. Signing helps prove that the installed artifact is the one that was signed. It does not prove that the skill is safe. That distinction matters. A signed bad skill is still a bad skill, just one with a stronger provenance story.
Skill cards are also valuable, but only if teams read them and enforce policy around them. Ownership, dependencies, limitations, known risks, and verification status should become part of the install decision, not decorative metadata.
Where SkillSpector Fits In An Agent Security Process
The strongest use of NVIDIA SkillSpector is as one control in a release and installation workflow for AI agent skills.
For third-party skills, teams should treat installation like adding a package dependency. Review the source, owner, stated purpose, dependencies, permissions, network behaviour, tools used, data touched, and update cadence. Run SkillSpector before installation. Block high-risk findings unless there is a clear exception, a compensating control, and a named owner willing to accept the risk.
For internal skills, scan on every change. Use SARIF or JSON output in CI so findings appear in the same place as code scanning results. Keep a baseline only for accepted findings, and make sure new findings break the build or require review. Once the skill is clean enough to publish, complete its skill card and sign the exact directory that will be distributed.
For runtime use, assume a clean scan is only the starting point. Agents still need bounded access. MCP servers should expose only the tools required for the workflow. Secrets should not be available by default. Network access should be constrained. Actions that send data externally, modify production systems, or make irreversible changes should require human approval.
Findings Worth Taking Seriously
Prompt injection findings deserve attention because they can reshape the agent's priorities. Hidden instructions, anti-refusal language, and directives to ignore earlier guidance are not harmless just because they appear in Markdown.
Data exfiltration findings are often more concrete. A skill that reads environment variables, enumerates sensitive directories, or transmits context externally should be treated as high risk until proven otherwise.
MCP-related findings are increasingly important. Tool descriptions and schemas can influence how an agent chooses and uses tools. Hidden instructions, overbroad permissions, wildcard access, and misleading tool metadata can create failures that are hard to spot in normal code review.
Supply-chain findings should be handled with the same discipline used for application code. Unpinned dependencies, remote script fetching, typosquatting risk, and vulnerable packages all matter more when the agent using the skill may already sit close to sensitive developer workflows.
Excessive agency findings need business judgement. A skill that can make high-impact decisions without human confirmation may be acceptable in a toy environment and unacceptable in a production workflow. The scanner can flag the shape of the risk. The organisation still has to decide the boundary.
How Palisade Can Help
Palisade helps teams adopt AI agents without treating the skill layer as trusted content by default. For organisations using tools such as Codex, Claude Code, Cursor, Gemini CLI, MCP servers, or internal agent workflows, we can review the skills and tool integrations that agents rely on, identify unsafe instructions or permissions, and define a practical approval process before those capabilities reach developers.
We also support implementation work: adding SkillSpector scans to CI, reviewing SARIF findings, designing skill intake policies, testing for prompt injection and data exfiltration paths, hardening MCP tool permissions, and validating whether runtime controls match the sensitivity of the data and systems involved.
For Singapore startups, SMEs, and larger companies experimenting with agentic AI, this is a good time to put lightweight governance in place. The controls do not need to slow teams down, but they should make unsafe skill installation harder than safe skill installation.
To discuss AI agent security, skill review, or MCP hardening, book a free consultation.
