Before you install that AI skill someone shared on X, scan it. In an analysis of 31,132 AI agent skills, 26.1% contained vulnerabilities and 5.2% looked malicious. NVIDIA open-sourced SkillSpector, the scanner it uses before publishing skills to its own catalog. 20.8K stars. → checks 71 attack patterns across 17 categories: prompt injection, data theft, privilege escalation, poisoned MCP tools and more → scans a GitHub repo, a URL, a zip or a folder → gives each skill a 0 to 100 risk score with a clear recommendation → fast scan with no AI, plus an optional deeper AI review → works for Claude Code, Codex and Gemini CLI skills Install: uv tool install git+github.com/NVIDIA/skillspect… Scan a skill: skillspector scan ./the-skill/ --no-llm Apache-2.0.