NVIDIA puts a checkpoint before agent skills install: 26.1% of 31,132 scanned skills carry vulnerabilities
AI agent skills run on implicit trust and get little vetting before installation. NVIDIA's open-source SkillSpector scans a repository, zip file, directory or single file before install, covering 71 vulnerability patterns in 17 categories with fast static analysis and an optional LLM semantic pass. In the 31,132-skill analyzed subset of its research dataset, 26.1% of skills contain vulnerabilities and 5.2% show likely malicious intent.