NVIDIA Releases SkillSpector: Open-Source Security Scanner for AI Agent Skills — Threadlinqs Intelligence
As of 2026-08-03, NVIDIA Releases SkillSpector: Open-Source Security Scanner for AI Agent Skills is a low-severity threat intel threat attributed to Multiple unattributed actors, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 27 indicators of compromise.
Threat ID: TL-2026-1828 · Severity: LOW · Status: TRACKING · Category: THREAT_INTEL
Attribution: Multiple unattributed actors · FINANCIAL
NVIDIA released SkillSpector, an Apache-2.0 open-source scanner that statically and semantically analyzes AI agent "skills" (SKILL.md instructions plus accompanying Python scripts) for 68
NVIDIA published SkillSpector (github.com/NVIDIA/SkillSpector, Apache-2.0), an open-source security scanner purpose-built for the AI agent "skill" ecosystem — Markdown instruction files (SKILL.md) often bundled with Python helper scripts that give agents like Claude Code, Codex CLI, Gemini CLI, and generic MCP-capable agents new capabilities. Skills are typically loaded on trust alone, with no code-signing or registry moderation equivalent to traditional package ecosystems, and unlike installed packages they can also carry natural-language instructions that an LLM will interpret and act on directly.
The release operationalizes findings from Liu et al.'s "Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale" (arXiv:2601.10338, Jan 2026), which scanned 42,447 skills and found 26.1% contained vulnerabilities, 5.2% showed likely malicious intent, and skills bundling an executable script were 2.12x more likely to be vulnerable than prose-only skills. SkillSpector runs a two-stage pipeline: a fast static pass (regex analyzers for prompt injection/credential access/memory poisoning/typosquatting/persistence; Python AST walking for exec/eval/subprocess/dynamic-import/getattr sinks; taint tracking from environment variables and file reads to network sinks; YARA matching for malware/webshells/cryptominers/hack-tools; and live OSV.dev dependency-CVE lookups with an offline fallback) and an optional LLM semantic pass (~87% precision, context-aware false-positive reduction) using hosted (OpenAI, Anthropic, Bedrock, NVIDIA build.nvidia.com), CLI, or fully local/self-hosted (Ollama, vLLM) providers. It also inspects skill metadata for homoglyphs, right-to-left Unicode overrides, zero-width characters, and HTML comments used to hide directives from human reviewers. Findings accumulate into a 0-100 risk score (executable content applies a 1.3x multiplier); scores above 50 are flagged DO NOT INSTALL and the CLI exits non-zero for CI gating. It can also run as an MCP server exposing a single scan_skill tool to gate installations at runtime, and emits terminal, JSON, Markdown, or SARIF output.
The release lands against a documented, active threat pattern rather than a hypothetical one. Snyk's February 2026 "ToxicSkills" audit of 3,984 skills from the ClawHub and skills.sh registries found 36.82% had at least one security flaw, 13.4% a critical-level issue, and confirmed 76 malicious payloads (8 still live at publication), including 40+ programmatically generated malicious skills from a single ClawHub account and a maintainer repository (NET_NiNjA.v1.2) shipping pre-deployment malware; 91% of confirmed-malicious skills combined traditional malicious code with prompt-injection techniques. In July 2026, the AgentBaiting campaign was reported distributing SmartLoader malware through roughly 7,600 fraudulent GitHub repositories (over 800 posing as AI Skills or MCP servers impersonating Claude Skills, Databricks MCP, Jenkins MCP, Docker MCP gateway, and Alibaba Cloud Skills), using obfuscated Lua stagers, scheduled-task persistence, and a StealC-derived injector to harvest browser sessions, credentials, OAuth tokens, and SSH keys — with DragonForce and Akira ransomware observed as secondary payloads against retail targets downstream of the infostealer precursor. Separately, the Cloud Security Alliance's May 2026 "SKILL.md Agent Context Poisoning" brief documented natural-language instruction injection (e.g., directives to append API-key environment variables to outbound URLs) and Unicode Tag-character (U+E0000-U+E007F) injection that renders invisibly to human reviewers but is parsed as semantic content by the LLM, and tied the risk class to two disclosed Claude Code vulnerabilities: CVE-2025-59536 (trust-dialog bypass allowing code execution before a user accepts a project's startup trust prompt, fixed in 1.0.111) and CVE-2026-21852 (project-load flow allowing malicious repository configuration to exfiltrate Anthropic AP
Weaknesses (CWE)
CWE-94, CWE-506, CWE-829, CWE-668
Target sectors: technology, software development, retail, financial services, government administration
Target regions: Global
Detections & IOCs
As of 2026-08-24, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 27 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
THREAT_INTEL, LOW, threat intelligence, cybersecurity, CVE-2025-59536, CVE-2026-21852, T1585, T1608, T1195, T1059, T1204, T1053, T1078, T1036, T1684.001, T1027
