NVIDIA SkillSpector for enterprise teams

A training guide for screening an agent skill before installation, understanding what a second-pass LLM can add, and turning scanner output into a defensible human decision.

Use the review runbook Inspect the demo skill

Last reviewed August 11, 2026 · SkillSpector 2.9.2

NVIDIA SkillSpector for enterprise teams: a six-part guide to static analysis, semantic review, and accountable approval decisions — NVIDIA SkillSpector for enterprise teams: scan to decide what deserves attention, then use people and policy to decide what earns trust.

The role: an early gate, not a safety certificate

Agent skills combine natural-language instructions with optional scripts, dependencies, references, assets, and tool access. That makes them both a software supply-chain artifact and a semantic control surface for an AI agent.

SkillSpector moves review ahead of installation and execution. It accepts repositories, URLs, archives, directories, and individual files, then produces terminal, JSON, Markdown, or SARIF findings. A passing scan narrows the review; it does not prove publisher identity, artifact integrity, runtime safety, or the absence of vulnerabilities.

26.1%of 31,132 studied skills had a pattern warranting review

5.2%showed high-severity patterns suggesting malicious intent

2.12×higher odds of findings when a skill included scripts

These are research screening results, not a claim that every flagged skill was malware. The study reports an aggregate 86.7% precision and 82.5% recall for its detection framework.

Use a three-stage decision path

Deterministic screenStatic analysis
Find recognizable strings, dangerous APIs, data flows, dependency risks, YARA signatures, and MCP permission issues.
Contextual reviewLLM semantic analysis
Compare the claimed purpose with instructions and code; look for paraphrased attacks, vague triggers, and subtle policy gaps.
Accountable gateHuman and policy decision
Verify provenance, permissions, destinations, source lines, accepted exceptions, integrity, and runtime controls.

What the preliminary pass does well

Static analysis is fast, deterministic, and suitable for an early repository review because it can run without sending the skill to an external model. NVIDIA documents 68 patterns across 17 categories in the current scanner.

Instruction risks: prompt injection, hidden instructions, trigger abuse, excessive agency, and unsafe output handling.
Code risks: dangerous calls, tainted flows from sensitive sources to risky sinks, and malware-oriented YARA signatures.
Supply-chain risks: vulnerable or unpinned dependencies, remote code retrieval, and suspicious packaging.
Tool risks: MCP least-privilege gaps, tool poisoning, and declared-permission mismatch.

Why it is preliminary

Literal rules can mistake a quoted attack example for an active instruction, and a novel paraphrase may avoid known signatures. Static output should prioritize the next inspection, not end it.

What an additional LLM can assess

The semantic stage reasons about meaning across files. It can ask whether the description agrees with the behavior, whether access fits the purpose, whether warnings are adequate, and whether apparently harmless language gradually steers the agent toward an unsafe outcome.

Semantic strengths

Paraphrased or indirect prompt injection
Description–behavior mismatch
Underdeclared capability or broad permissions
Vague triggers and missing warnings
Contextual explanations and remediation

Semantic limits

Model output can vary across runs and providers
The model can misunderstand legitimate security content
Repository text may be adversarial model input
The analysis does not execute every runtime path
External model use creates data-governance questions

Use an enterprise-approved provider and data-handling boundary. Treat the model's intent assessment as supporting evidence—not a factual claim about the author.

Run the exact artifact in two passes

A mutable default branch can change after review. For a final decision, record the intended commit, check it out locally, and scan the precise skill directory or release artifact.

Pass 1 · static-only JSON reportskillspector scan ./checked-out-skill --no-llm --format json --output preliminary-static.json

Pass 2 · approved LLM provider configuredskillspector scan ./checked-out-skill --format json --output semantic-review.json

Current NVIDIA installation guidance also supports a global, CLI-only install with uv tool install. Check the release page before training or production use; scanner rules and semantic resilience change over time.

Read completeness before the score

Output field	Question for the reviewer
Scanner version	Which code and rule set produced this evidence?
LLM requested / available	Was semantic analysis intended, and could it run?
Meta-analysis / degraded status	Did contextual review apply or fail closed?
Coverage and limitations	Were all discovered components actually analyzed?
Suppressions	What was removed from scoring, by whom, and why?
Finding location and confidence	What source line supports the finding, and how certain is the detector?

Finding confidence affects prioritization; it is not the confidence of the whole scan. A tag such as llm-unconfirmed means a severe static finding was retained even though the model did not validate it.

Interpret the score as triage

0–20Low · Safe

Continue provenance, permission, and code review.

21–50Medium · Caution

Require a named reviewer before installation.

51–80High · Do not install

Block until fixed or formally accepted.

81–100Critical · Do not install

Block and escalate to security.

The score is not a probability that the skill is malicious and it is not a percentage-safe value. Parse the report: a process exit code of zero can still contain a medium/caution result.

Make the enterprise decision explicit

Block any critical or high finding unless it is remediated or formally risk-accepted.
Require human disposition for medium, degraded, incomplete, or suppressed results.
Review scripts, network use, credential access, subprocesses, and destructive actions even when the aggregate score is low.
Pair scanning with provenance, signing, least privilege, sandboxing, egress control, secret isolation, and monitoring.
Re-scan when the skill, dependency set, scanner, model, or policy changes.

Scan to decide what deserves attention. Use people and policy to decide what earns trust.

Presentation and training sources

← Back to the resource library