NVIDIA puts a checkpoint before agent skills install: 26.1% of 31,132 scanned skills carry vulnerabilities

Agent skills now get an executable check before installation: the scanner reads a candidate skill and returns a risk score with a recommendation. Such skills previously executed under implicit trust with minimal vetting, so the install decision had no inspection result behind it. In the 31,132-skill analyzed subset of the research dataset, 26.1% of skills contain vulnerabilities and 5.2% show likely malicious intent.

The scanner splits inspection into two stages: fast static analysis first, then an optional LLM semantic evaluation. Static analysis handles structured matching, while semantic evaluation covers judgments static rules handle poorly, and the two can run separately. Input can be a Git repo, URL, zip file, directory or single file, and output supports terminal, JSON, Markdown and SARIF formats.

Checks are organized as 71 vulnerability patterns across 17 categories, including prompt injection, data exfiltration, privilege escalation, supply chain, excessive agency, system prompt leakage, memory poisoning, tool misuse, MCP least privilege and MCP tool poisoning. Beyond pattern matching, it includes AST-based dangerous-code checks, taint tracking and YARA signatures, and queries OSV.dev for live CVE data with automatic offline fallback. Risk is scored 0 to 100 with severity labels; known findings can be accepted via a glob-rule or fingerprint baseline so re-scans surface only new issues.

The demonstrated scope is pre-install scanning: run against a Git repo, URL, zip file, directory or single file, emitting terminal, JSON, Markdown or SARIF reports, and usable as a Pi or OpenCode tool inside agent sessions.

The 26.1% and 5.2% figures come from the 31,132-skill analyzed subset of the research dataset, and the material does not say how that subset was drawn or how malicious intent was judged; semantic evaluation is optional, so without it only static analysis runs.