NVIDIA Open-Sources SkillSpector to Audit AI Agent Tools and Skills
NVIDIA has released SkillSpector, an open-source Python security scanner designed to audit AI agent skills and tools prior to installation. It identifies prompt injection, malicious code patterns, data exfiltration, and supply-chain vulnerabilities across platforms like Claude Code, Codex, and Model Context Protocol (MCP) skills. As autonomous AI agents increasingly execute code and access external databases via protocols like MCP, unverified skills introduce major security and supply-chain threats. SkillSpector provides developers and enterprises with a critical pre-deployment safety net to securely expand their AI agent capabilities. Written in Python, SkillSpector gained over 3,300 GitHub stars within a month, reflecting intense industry interest in AI safety tooling. It specifically inspects integrations meant for LLM environments, catching rogue instructions and untrusted third-party dependencies before code execution.
## BACKGROUND
Modern AI agents connect to external tools and context sources using open standards like Anthropic's Model Context Protocol (MCP). However, integrating third-party tools exposes systems to prompt injection attacks, where malicious inputs manipulate large language models into unauthorized behavior or data leakage.