skill-scanning

NVIDIA has open-sourced SkillSpector, a tool designed to statically scan skills for Claude Code, Codex, and MCP, with optional review by a large language model, to detect risks such as prompt injection, data theft, and supply chain poisoning. Scan results show that roughly a quarter of more than 30,000 skills contain vulnerabilities.

AgentGuard 是一款免费工具，可在安装前扫描 AI agent 的 SKILL.md 文件，检测安全风险、隐藏能力和质量问题，并生成包含评分与结论的 Trust Report。