The SkillSpector Install Gate.

1. Source. Is the repository owned by the company or person who claims to publish it?
2. Scope. Does the skill need every tool and permission it requests?
3. Scripts. Does it contain executable files? If yes, who read them?
4. Network. Which domains can receive data, and does that match the stated job?
5. Version. What exact commit or release did you approve?

If you cannot answer all five, the skill is not ready for a company-connected agent.

The company policy to paste into your own rules

Put this in your security handbook, AI policy, or agent setup instructions. Replace the bracketed fields.

AI SKILL INSTALLATION POLICY

No employee or agent may install an AI skill directly from a social post,
message, marketplace page, or search result.

Before installation:

1. Record the source repository and the exact commit or release.
2. Run SkillSpector against the complete skill bundle.
3. Save the report with the date, scanner version, and scan mode.
4. Review the skill's scripts, requested permissions, and external domains.
5. Name the person approving the installation.

Decision rule:

SAFE: Manual review still required before installation.
CAUTION: Installation requires written approval from [OWNER OR TEAM].
DO NOT INSTALL: Block until the source is fixed and a new scan passes.

A static-only scan must be labelled STATIC ONLY.
A failed or incomplete scan is not a pass.
A later update is a new artifact and must be scanned again.

Never test an unapproved skill inside an agent connected to production,
customer data, company repositories, shared drives, payment systems,
or live credentials.

The last two lines are the part most companies miss. A scan belongs before installation, and every update resets the decision.

How to save a report someone else can review

Terminal output is useful while testing. A Markdown report is better for an approval record:

skillspector scan https://github.com/OWNER/REPOSITORY \
  --no-llm \
  --fail-on-incomplete \
  --format markdown \
  --output scan-report.md

JSON is the better format when you want an automated gate:

skillspector scan https://github.com/OWNER/REPOSITORY \
  --no-llm \
  --fail-on-incomplete \
  --format json \
  --output scan-report.json

SARIF is available for code scanning systems and IDE tooling:

skillspector scan https://github.com/OWNER/REPOSITORY \
  --no-llm \
  --fail-on-incomplete \
  --format sarif \
  --output scan-report.sarif

One detail matters in automation. SkillSpector exits with code 0 for both SAFE and CAUTION. It exits with code 1 only when the score is above 50. If your company wants CAUTION to require approval, read the recommendation field in the JSON report instead of relying only on the exit code.

The full scan, and the privacy choice it creates

Static analysis catches suspicious strings, dangerous Python calls, known dependency problems, permission mismatches, hidden artifacts, and common exfiltration patterns. It is fast and does not send the skill's file contents to an LLM.

Semantic analysis checks intent. It can notice that a cooking assistant contains behavior with no connection to recipes, or that a harmless description sits above a script that searches for secrets and sends data away.

That extra judgment has a cost. With semantic analysis enabled, SkillSpector sends analyzer-eligible file contents to the model provider you configure. If the skill itself contains private company material, decide whether that provider is allowed to receive it before running the full scan.

For an OpenAI-backed scan:

export SKILLSPECTOR_PROVIDER=openai
export OPENAI_API_KEY=your-key
skillspector scan ./path-to-skill --fail-on-incomplete

For an Anthropic-backed scan:

export SKILLSPECTOR_PROVIDER=anthropic
export ANTHROPIC_API_KEY=your-key
skillspector scan ./path-to-skill --fail-on-incomplete

You can also use authenticated Claude CLI or Codex CLI sessions without handing SkillSpector a separate API key. The official provider table lists the current setup for each option.

My rule would be simple. Run the static scan first. If it raises anything serious, stop there. Use semantic analysis only after the static pass and only with a provider your company already permits.

The part most coverage skips: the scanner is not a sandbox

NVIDIA says this directly: SkillSpector is defense in depth, not a sandbox.

It never executes the skill during analysis. That is good. It also means the scanner cannot observe what the skill will do only at runtime, what an encrypted or compiled file hides, or what text inside an image says. It can miss non-English attacks, and its LLM judgment can produce false positives or false negatives.

A SAFE result does not make the skill harmless. It means the scanner did not find enough evidence to classify it as unsafe under the checks it ran.

The fix is not another scanner. The fix is containment:

• Install the skill first in a test agent with no production credentials.
• Give the agent only the files and tools needed for that test.
• Keep sending, publishing, payments, account changes, and deletions behind approval.
• Record the exact version you approved.
• Scan again whenever the skill changes.

Scanning decides whether a skill deserves a test. Isolation decides how much damage a missed problem can do.

The three artifacts you need

One, the scan report. Save it as scan-report.md or scan-report.json. It should show the target, date, SkillSpector version, whether LLM analysis ran, the score, the recommendation, and every finding.

Two, the approval record. Create skill-decision.md. Record the source URL, exact commit, owner, requested permissions, external domains, report link, approver, decision, and next review date. A scan without a decision record disappears into a terminal window and teaches the company nothing.

Three, a written skill policy, 200 to 400 words, and almost nobody has one. Write which company systems an agent may reach, which data must never leave your environment, who can approve a CAUTION result, what actions always require human approval, and how quickly an update must be rescanned. The scanner can tell you what it found. This file tells your team what to do about it.

Using the NVIDIA verified catalog

When the skill you need already exists in the NVIDIA skills catalog, start there rather than from a repost or fork. NVIDIA's pipeline catalogs, scans, evaluates, signs, and documents skills before publication.

List the available NVIDIA skills without installing anything:

npx skills@latest add nvidia/skills --list

When you have chosen a skill, install that specific skill with:

npx skills@latest add nvidia/skills --skill SKILL-NAME --yes

Verified does not mean every future version is approved forever. Record the version you installed, keep the permissions narrow, and scan third-party forks separately.

If something goes wrong

Honest limits

SkillSpector can miss runtime-only behavior, encrypted or compiled code, text hidden in images, and some non-English attacks. Semantic analysis adds judgment, but that judgment can still be wrong.

The score is a triage device. A zero is not a warranty, and a CAUTION result is not automatically harmless because the process returned a successful exit code.

The scanner checks the skill bundle you point it at. It does not prove that the repository owner is honest, that the download was not replaced later, or that a safe skill cannot become dangerous after an update.

LLM analysis sends eligible file contents to the configured model provider. Static scans avoid that content transfer, but dependency names and versions may still go to OSV.dev for live vulnerability checks.

SkillSpector does not contain an installed skill. If you approve one, the agent still needs narrow permissions, a test environment, and human approval around sensitive actions.

The software is free under the Apache 2.0 license. Your cost is the time spent reviewing findings and any model usage you choose to add for semantic analysis.

What this changes

Agent skills used to feel like prompts. They now carry enough code, permissions, dependencies, and persistent instructions to deserve the same question you ask before installing software: who wrote this, what can it reach, and what happens when it runs?

SkillSpector turns that question into a repeatable check that takes minutes. The report gives you evidence. The install policy gives your team a decision. The isolated test limits the damage if both miss something.

The safe habit is simple: scan the exact version, save the report, name the approver, then install it with the smallest permissions that let it do its job.

LINK