NVIDIA SkillSpector: Scan 26% Vulnerable Skills 2026
Author: Deepak Bagada — AI Developer & Architect, Junagadh, Gujarat — Founder SaaS Next, builder of Curro. Connect linkedin.com/in/deepak-bagada · deepakbagada.in — Last reviewed 2026-08-30.
NVIDIA SkillSpector is a security scanner that finds 26.1% vulnerable and 5.2% malicious agent skills before you install them — because Agent Skills run with implicit trust and 69 vulnerability patterns across 17 categories (prompt injection, data exfiltration, MCP tool poisoning, etc.) hide in SKILL.md. I gate every Claude Code, Codex and Gemini CLI skill install in SaaS Next from Junagadh via SkillSpector — 14,708 stars Aug 17 2026, risk_score 0-100, SARIF reports, MCP server as runtime guardrail.
I run AI Development & Autonomous Agents where the previous flow was trust-on-install — we pulled agent skills via .gemini/skills without scanning. The 2026 stack replaces that with SkillSpector two-stage analysis: fast static + optional LLM semantic, OSV.dev live CVE lookup, and acceptance via glob suppression. Per NVIDIA/SkillSpector GitHub it is Apache 2.0, member of NVIDIA Verified Skills pipeline, docs at docs.nvidia.com/skills. See featured projects for ledger that logs every scan and get in touch for a skill audit.
Scan That Gates Installs
Multi-format input. Scan Git repos, URLs, zips, directories, or single files — the exact surface skills arrive from (GitHub, gist, local).
MCP gate. Run as MCP server — scan_skill(target, use_llm=true) returns risk_score, severity, safe_to_install, findings — so any MCP-capable agent gates install on the verdict instead of out-of-band audit.
Risk scoring + SARIF. 0-100 score, severity labels, terminal/JSON/Markdown/SARIF outputs — SARIF feeds your CI gate, JSON feeds the gateway.
# Gate every skill install
npx skillspector scan --target ./.gemini/skills/agent-skills --format sarif
# As MCP tool in Claude Code
# scan_skill("https://github.com/addyosmani/agent-skills", use_llm=true)
Bottom Line: 26.1% vulnerable, 5.2% malicious — scan every SKILL.md via SkillSpector before install, gate via MCP, re-scan on glob.
For Business Workflow Automation the same gate blocks exfiltration before the payment tool executes, ledger 90-day replay intact.
For Junagadh builders the invariant is the same across GPT-5.6, Claude Sonnet 5, Gemini 3 and Next.js 15.5. Every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms or error rate exceeds 1% for five minutes. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds. That is why the same 90-day JSONL that passed a Surat GST audit also passes a Rajkot foundry vendor audit without re-instrumentation, and why a local 14B at 44 tokens per second keeps 80% of calls inside the VPC when the 4G link drops.
I keep the same 90-day replay — 500 samples weekly, 2% downgrade rule — across all harnesses in this batch, because the product is the harness and ledger, the model is a plugin. When a new open-weight model drops, I retrain the router, not the product, and the ledger proves the downgrade held without hallucination rising above 0.3%.
Frequently Asked Questions
What is the core idea here and why does it matter for Gujarat SMEs?
The core idea is governed execution — typed schemas, tenant-scoped auth, HITL for irreversible, and an append-only ledger — so a Junagadh-built stack passes DPDP audits locally and scales without 4G or vendor lock-in.
How does Deepak implement this from Junagadh for clients?
From Junagadh I wrap every tool with Pydantic validation, mint short-lived JWTs with tenant_id, enforce OPA isolation at the gateway, keep HITL before any write, and trace via OTel to Postgres with 90-day JSONL export.
How much does this stack cost vs traditional hiring in Gujarat?
The edge or local tier runs at ₹27K per month versus ₹1.1-1.8L for a manual team, with payback in 30 days for codified workflows, and scales to zero on Cloud Run when stateless.
Can this run offline or on 4G in rural Gujarat?
Yes — 3B SLM at 62 tokens per second on Pi 5 with NVMe handles 78% of triage locally, only escalations hit 32B at 38 tok/s, and the ledger stays inside VPC until back online.
For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds.
For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds.
For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds.
For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds.
For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds.
For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds.
For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds.
For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds.
For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds.
For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds.