@Godgun522: Before installing a skill, have NVIDIA give it a once-over. NVIDIA/SkillSpector is now open source, specifically designed to scan skills for Claude Code, Codex, and MCP for issues like prompt injection, data theft, and supply chain poisoning. It starts with a static scan, followed by an optional LLM review, the most…
Summary
NVIDIA has open-sourced SkillSpector, a tool designed to statically scan skills for Claude Code, Codex, and MCP, with optional review by a large language model, to detect risks such as prompt injection, data theft, and supply chain poisoning. Scan results show that roughly a quarter of more than 30,000 skills contain vulnerabilities.
View Cached Full Text
Cached at: 10/28/26, 11:41 AM
Before installing a skill, let NVIDIA give it a once-over.
NVIDIA/SkillSpector is now open source, built specifically to scan skills for Claude Code, Codex, and MCP for issues like prompt injection, data theft, and supply chain poisoning. It starts with a static scan, then optionally has an LLM review the findings, and finally assigns a risk score.
They scanned over 30,000 skills. A quarter had vulnerabilities, and 5% looked deliberately malicious.
Do you take a look at the source code before installing a skill?
Similar Articles
NVIDIA/SkillSpector
NVIDIA's SkillSpector is a security scanner for AI agent skills that detects vulnerabilities, malicious patterns, and security risks before installation.
@FakeMaidenMaker: Have you installed the best Skills for Codex? These 6 skills (can be installed for Codex, Claude Code, and Cursor) will make it far more powerful than you imagine. Their reputation has been proven by major communities: 1. Superpowers (ob…
Recommends six Skill plugins to enhance AI coding assistants like Codex, Claude Code, and Cursor, including Superpowers, OpenAI official plugins, claude-mem, Agent-Reach, GitNexus, and Humanizer-zh, covering working methodologies, long-term memory, internet access, code understanding, etc.
@IndieDevHailey: reverse-skill: A reverse-engineering/pentesting/security skill routing pack. Specifically designed for AI tools like Claude Code and Cursor. When it comes to APK, binary, JS encryption, CTF, or pentesting work, it directly routes you to the correct methodology + local tools, without guessing commands. …
reverse-skill is a reverse-engineering/pentesting/security skill routing package designed for AI coding tools such as Claude Code and Cursor. It automatically routes to the correct methodology and local tools, covering APK, binary, JS encryption, CTF, firmware, Pwn, and more.
@LinearUncle: Software development at this stage has entered the skill era. Matt Pocock skills, superpowers, oh-my-opencode, gstack, lazycodex, etc.—these geniuses' skills are the libraries worth deeply studying, improving, and then using for yourself. Don't…
Matt Pocock has released a set of agent skills designed for coding agents like Claude Code, Codex, etc., including skills like grill-me and grill-with-docs, aimed at improving alignment and reducing verbose output, emphasizing small size, adaptability, and composability.
@XAMTO_AI: Stop using Claude Code as a chatbot. Those who really know how to play have already filled it with hacker brains. 51 practical skills, 574+ report templates, 24 types of vulnerability tactics — one-click install, turning a noob into a seasoned bounty hunter. You're still watching, while others are already collecting bug bounties. https://githu…
Introducing Claude-BugHunter, a skill pack designed for Claude Code, containing 71 skills, 15 slash commands, and 681 public report patterns, aiming to transform Claude Code into an advanced bug bounty hunter or red team operator.