arrow_backAI Skill ShieldpublicDefault-branch GitHub scan
Trust report
NVIDIA/SkillSpector
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
View scanned commit on GitHubopen_in_new0%Static score
74% score26% score gap
Highest finding: High severityLatest scan
high severity
Static analysis score
Install decision
Needs Manual Review
The scan is usable, but install-time behavior still needs a human look before any agent install step.
Scan identity
- Scanned
- 2026-08-08
- Commit
- 2bc641fd0639
- License
- Apache-2.0
- Repository
- Active
Repository scan summary
- policyFindings
- 232
- terminalInstall surface
- 5
- Repository reach
- 14,357
Validation findings detected
Execution paths reviewed
GitHub stars
Highest-priority findings
The latest default-branch scan, ordered by severity.
- highInvalid characters in nametests/fixtures/mcp_poisoned_tool/SKILL.md
- highIgnore previous instructionstests/fixtures/mcp_poisoned_tool/SKILL.md:10
- mediumNo usage examplestests/fixtures/malicious_skill/SKILL.md
- mediumNo agent compatibility detectedtests/fixtures/malicious_skill/SKILL.md
- mediumNo usage examplestests/fixtures/mcp_clean_skill/SKILL.md
Share this trust result
The badge stays linked to the latest default-branch scan for this skill path.
Do you consider this skill safe to use?
Community signals help prioritize human review; they do not change the scan verdict.
AI Skill Shield is an automated pre-install review, not a guarantee of safety. Confirm sensitive permissions and execution paths before installation.