Research on 42,447 skills — Liu et al., 2026

Is this AI skill safe to install?

26.1% of AI agent skills contain vulnerabilities. 5.2% show likely malicious intent. AI Fraud Scan runs 65 security patterns across 16 risk categories before the skill reaches your machine.

Scan a File Now Install CLI
terminal
 SkillSpector Security Report  v2.0.0

Skill:   suspicious-skill
Source:  ./suspicious-skill/
Scanned: 2026-01-29 10:30:00 UTC

        Risk Assessment
 Score           78/100
 Severity        HIGH
 Recommendation  DO NOT INSTALL

Issues (2)

  HIGH: Env Variable Harvesting (E2)
    Location: scripts/sync.py:23
    Finding: for key, val in os.environ.items()...
    Confidence: 94%

  HIGH: External Transmission (E1)
    Location: scripts/sync.py:45
    Finding: requests.post("https://api.skill.io/env"...
    Confidence: 89%
42,447skills analyzed in research
26.1%contain ≥1 vulnerability
5.2%likely malicious intent
2.12×riskier with executable scripts

Browser Scanner

Drop a SKILL.md or .py file — analysis runs entirely in your browser, nothing is uploaded

🛡️

Drag & drop your SKILL.md or .py file here

or

Supported: .md · .py · .txt · .yaml · .sh · .js · .ts

Everything you need for a complete audit

📂

Multi-format input

Scan Git repos, URLs, ZIP files, directories, or a single SKILL.md — all formats accepted.

⚡

Two-stage analysis

Stage 1: fast static regex + AST + YARA. Stage 2: optional LLM semantic evaluation reaching ~87% precision.

🔍

Live CVE lookups

SC4 queries OSV.dev in real-time — tens of thousands of advisories, no API key required, automatic offline fallback.

📊

Multiple report formats

Terminal output, JSON for automation, Markdown for docs, and SARIF for CI/CD and IDE integration.

🎯

Clear risk score 0–100

CRITICAL +50 · HIGH +25 · MEDIUM +10 · LOW +5. Executable scripts multiply the score by 1.3×.

🐳

Docker ready

Run with no Python installation. Fully isolated Docker image, Dockerfile included in source.

16 Categories · 65 Security Patterns

Each category targets a different class of threat — from direct attacks to hidden manipulations

5 patterns

Prompt Injection (P1–P5)

Instruction overrides, hidden directives in comments/invisible text, exfiltration commands, behavior manipulation, harmful content.

4 patterns

Data Exfiltration (E1–E4)

Sending data to external servers, harvesting API keys & env vars, file system enumeration, context leakage.

3 patterns

Privilege Escalation (PE1–PE3)

Permissions beyond stated function, sudo/root execution, access to SSH keys, AWS credentials, browser cookies.

6 patterns

Supply Chain (SC1–SC6)

Unpinned deps, curl|bash RCE, obfuscated base64/hex code, live CVE lookup via OSV.dev, typosquatting.

4 patterns

Excessive Agency (EA1–EA4)

Unrestricted tool access, autonomous high-impact decisions without human-in-the-loop, scope creep, unbounded resources.

3 patterns

Output Handling (OH1–OH3)

Unsanitized model output injection, cross-trust-boundary data flow, unbounded output generation.

3 patterns

System Prompt Leakage (P6–P8)

Direct exposure of internal instructions, indirect extraction via translation/side-channels, exfiltration via file writes or network.

3 patterns

Memory Poisoning (MP1–MP3)

Content designed to persist across sessions, context window stuffing to displace safety constraints, agent memory tampering.

3 patterns

Tool Misuse (TM1–TM3)

Crafted parameters for unintended behavior (shell=True, --force), tool chains bypassing individual safety checks.

2 patterns

Rogue Agent (RA1–RA2)

Self-modification at runtime, unauthorized persistence via cron jobs or startup scripts.

3 patterns

Trigger Abuse (TR1–TR3)

Overly broad triggers, shadow commands overriding built-ins, keyword baiting to maximize activation.

9 patterns

Behavioral AST (AST1–AST9)

exec(), eval(), dynamic __import__, subprocess, os.system, compile(), dangerous execution chains, reflective getattr() sinks.

5 patterns

Taint Tracking (TT1–TT5)

Direct source-to-sink flow, credential exfiltration chains, file-read-to-network, external input to exec/eval.

4 patterns

YARA Signatures (YR1–YR4)

Known malware signatures, webshell patterns, cryptominer indicators, hack tools and exploit code.

4 patterns

MCP Least Privilege (LP1–LP4)

Undeclared capabilities, wildcard permissions, missing permission declarations, overdeclared permissions.

4 patterns

MCP Tool Poisoning (TP1–TP4)

Hidden instructions in HTML comments/zero-width chars, Unicode/RTL deception, parameter description injection.

Risk Score Explained

Calculation

  • CRITICAL+50 pts per finding
  • HIGH+25 pts per finding
  • MEDIUM+10 pts per finding
  • LOW+5 pts per finding
  • Executable scripts × 1.3

Thresholds

ScoreSeverityAction
0 – 20LOW✅ SAFE
21 – 50MEDIUM⚠️ CAUTION
51 – 80HIGH🚫 DO NOT INSTALL
81 – 100CRITICAL🚫 DO NOT INSTALL

Install & Use

🚀 Quick install via uv

uv tool install git+https://github.com/NVIDIA/skillspector.git

# Update later
uv tool update skillspector

🐍 From source via pip

git clone https://github.com/NVIDIA/skillspector.git
cd skillspector
uv venv .venv && source .venv/bin/activate
make install

🐳 Docker (no Python needed)

docker build -t skillspector .
docker run --rm -v "$PWD:/scan" \
  skillspector scan ./my-skill/ --no-llm

Scan commands

# Scan a local directory
skillspector scan ./my-skill/

# Scan a Git repo
skillspector scan https://github.com/user/my-skill

# Scan a ZIP file
skillspector scan ./my-skill.zip

# Static analysis only (faster, fully local, no LLM)
skillspector scan ./my-skill/ --no-llm

# JSON output for automation
skillspector scan ./my-skill/ --format json --output report.json

# SARIF for CI/CD
skillspector scan ./my-skill/ --format sarif --output report.sarif

LLM configuration (optional, for semantic analysis)

# Anthropic Claude
export SKILLSPECTOR_PROVIDER=anthropic
export ANTHROPIC_API_KEY=sk-ant-...
skillspector scan ./my-skill/

# OpenAI
export SKILLSPECTOR_PROVIDER=openai
export OPENAI_API_KEY=sk-...
skillspector scan ./my-skill/

# Local Ollama (fully offline)
export SKILLSPECTOR_PROVIDER=openai
export OPENAI_API_KEY=ollama
export OPENAI_BASE_URL=http://localhost:11434/v1
export SKILLSPECTOR_MODEL=llama3.1:8b
skillspector scan ./my-skill/

FAQ

What is AI Fraud Scan?

AI Fraud Scan is the web front for SkillSpector — an open-source CLI tool by NVIDIA (Apache 2.0) that scans AI agent skills for malicious patterns and vulnerabilities before installation.

How dangerous are AI skills really?

Research "Agent Skills in the Wild" (Liu et al., 2026) analyzed 42,447 skills from major marketplaces: 26.1% contain at least one vulnerability, 5.2% show likely malicious intent, and skills with executable scripts are 2.12× more likely to be vulnerable.

Does the browser scanner upload my files?

No. The browser scanner runs 100% client-side using JavaScript — your files are never sent anywhere. The CLI tool optionally sends file contents to an LLM provider for semantic analysis; use --no-llm to keep everything local.

Can I integrate it into CI/CD?

Yes. Exit code 0 = safe/caution, exit code 1 = do not install. SARIF and JSON outputs integrate directly with GitHub Actions, Jenkins, and any IDE supporting SARIF.

What's the difference between static analysis and LLM analysis?

Static analysis (regex + AST + YARA) is fast and covers known patterns. LLM analysis is optional, improves precision to ~87% by evaluating context and hidden intent, but sends file contents to the configured provider.

Does it execute the scanned skill?

Never. All analysis is static — the skill's code is read but never run. SkillSpector flags risks before installation; it does not sandbox or isolate skills you choose to install anyway.