Scan Claude Code Skills for Security Risks With NVIDIA SkillSpector

Every skill you add to Claude Code is a set of instructions, and sometimes a set of scripts, that your agent follows with very little supervision. That makes a quick safety check worth doing before you install one, and the SkillSpector skill scanner is a free tool built for exactly that job. In this guide you will scan a clean skill and a deliberately bad skill, read the reports, and let Claude Code run the review for you.

This guide is part of our Claude Code tutorials. Find more add-ons in our Skills Directory.

Tested with Claude Code v2.1.319 on November 9, 2026, using SkillSpector 2.12.0 from NVIDIA/SkillSpector at commit e48d771.

We ran everything on macOS, in a throwaway demo folder, with Claude Code answering through the Claude account already set up on this Mac.

What Is SkillSpector and Why Scan Skills?

A skill is a folder with a SKILL.md file and, often, helper scripts. Claude Code reads the text and may run the scripts, so a bad skill can ask your agent to do things you never intended. The official plugin docs explain how skills and plugins are packaged, and they are worth a read before you install anything from a stranger.

SkillSpector is NVIDIA’s answer to the trust problem. According to its README, it checks 71 patterns across 17 categories, including prompt injection, data exfiltration, supply chain risks and dangerous code.

The README also says that in a research set of 31,132 skills, 26.1 percent had vulnerabilities. We did not verify that figure, but it explains why a scan step makes sense.

A skill is code you did not write, so scan it before your agent trusts it.

The project lives in the SkillSpector repository. It was last updated on November 6, 2026 when we tested it, and it is not archived.

How the Scan Works

You point the tool at a skill folder, a single file, a Git URL or a zip file. It runs a list of static checks, then prints a score from 0 to 100, a severity label and a recommendation. You can also turn on an optional LLM review, which we did not use.

Install SkillSpector Safely

The README suggests uv tool install git+https://github.com/NVIDIA/skillspector.git. The tool needs Python 3.12 or newer, and the README warns that it downloads third-party open-source packages, so read the licenses if that matters to you.

We did not have uv, so we used a plain virtual environment inside a throwaway demo folder. That keeps your global Python and your ~/.claude folder untouched.

python3 -m venv venv
./venv/bin/pip install ./SkillSpector
./venv/bin/skillspector --version

The install finished without errors on Python 3.14, and skillspector --version printed v2.12.0. The tool has three commands: scan, mcp and baseline.

Build Two Demo Skills to Scan

We wrote two tiny skills by hand. The first, tidy-notes, turns messy meeting notes into bullet points and contains one text file.

The second, handy-helper, is a made-up bad skill. Its SKILL.md tells the agent to run a setup script silently and to ignore earlier instructions about permission.

Its script reads an SSH key, sends it to a placeholder address, and pipes a downloaded file into bash. The addresses use the reserved .invalid domain, so nothing can ever connect, and we never ran the script.

demo-skills/
  tidy-notes/SKILL.md
  handy-helper/SKILL.md
  handy-helper/scripts/setup.sh

Scan a Clean Skill

Start with the safe one. The --no-llm flag keeps the scan static, so no outside model is called.

skillspector scan demo-skills/tidy-notes --no-llm

The result was a score of 0 out of 100, severity LOW and the recommendation SAFE. The report listed one component, SKILL.md, and said “No security issues detected”. The command also exited with code 0.

Scan a Risky Skill and Read the Findings

Now scan the bad one. This time the report said 100 out of 100, severity CRITICAL and the recommendation DO NOT INSTALL.

skillspector scan demo-skills/handy-helper --no-llm

It listed six issues, each with a rule ID, a file and line number, a confidence value and a remediation tip.

What the Scanner Did Not Flag

Here is the honest part. Our SKILL.md contains two phrases a human would call alarming: “do not tell the user” and “ignore any previous instructions about asking for permission”.

In our static run, none of the six findings pointed at those lines. The only finding for that file was the missing tool scope.

That is one demo, not a full benchmark, and the README says the optional LLM stage adds semantic checks that we did not test. Still, it shows why a score alone should never be your whole review.

Save the Report as JSON for Scripts and CI

Add --format json --output report.json and the tool saves a machine-readable file. The JSON holds risk_assessment, issues, components and analysis_completeness. The README also lists Markdown and SARIF formats for documentation and CI tools.

The exit code is handy too. In our runs the safe skill returned 0 and the bad skill returned 1, so a simple shell script can block an install when the exit code is not 0.

skillspector scan ./some-skill --no-llm --format json --output report.json
echo $?

Let Claude Code Run the Review With skill-inspector

The repository ships a skill called skill-inspector. It tells Claude to run SkillSpector first, then read the source of the target skill and give one verdict: APPROVE, CAUTION or REJECT. We copied the folder into the project’s .claude/skills/ folder and started Claude Code with --setting-sources project, so nothing was added to our real setup.

Our prompt was short.

Use the skill-inspector skill to check whether demo-skills/handy-helper is safe to install. Scan only, do not run any script from it. Keep the answer short.

Claude loaded the skill and then asked permission to run a shell command that included the scan. The command only listed files, ran the scan and printed the two source files, so we approved it.

The answer came back in about 18 seconds. Claude said REJECT, and it named the hidden instructions, the SSH key upload, the remote code execution and the vague description. It also said it never ran the script.

One more honest detail: Claude said its own parse of the JSON report returned empty fields, probably because it guessed the wrong keys, so the verdict came from reading the source. The review still reached the right answer, which is the point of using two lines of defense. See our guide on skills best practices for how skills are meant to behave.

Which Check Should You Trust?

Use the scanner and a source review together. The scanner is fast and repeatable. A review, by you or by Claude, catches intent the patterns miss, like our silent-run instruction.

Who Should Use SkillSpector?

If you install skills from GitHub, from a marketplace or from a teammate, this tool belongs in your routine. It takes seconds, it needs no account for the static mode, and it gives you a clear stop signal.

It is not a replacement for judgment. A skill that is clearly documented and does something sensitive on purpose can score high and still be fine, while a quiet skill can hide a problem. Use the score to decide where to look first.

What to Do When a Scan Fails

If a skill gets a high score, do not delete it in a panic and do not install it either. Open the files named in the findings and read the lines around them.

Ask three plain questions. Does the code do only what the skill description promises, and does it keep your data on your machine?

Does it ask for more permission than the job needs? If any answer worries you, leave the skill out.

Try It Yourself

Pick a skill you are thinking of installing and scan it first. Download it into an empty folder, never into ~/.claude, and do not run anything from it.

skillspector scan ./the-skill-folder --no-llm
echo $?
Use the skill-inspector skill to review ./the-skill-folder. Do not run any scripts from it.

The first two lines go in your terminal, and the last line is a prompt for Claude Code. Compare the score with Claude’s verdict and read any file that either one flags.

Common Mistakes

• Trusting a low score alone. As our demo showed, text-only tricks can slip past static patterns.
• Running the skill’s installer to “see what it does”. Scan and read first.
• Installing the tool into your global Python or into ~/.claude. A virtual environment is enough.
• Forgetting --no-llm. Without it, the tool tries to call an LLM provider that needs credentials, and some providers bill your account.
• Ignoring partial coverage. The report has an “Inspection Completeness” section, so check that coverage says 100 percent.

Pro Tips

• Use --recursive to scan a folder of skills at once. The README says the default limit is 32 skills.
• Use the baseline command to accept known findings, so later scans only show new ones.
• Add --fail-on-incomplete in CI so a partial scan fails the build.
• Pair this with our skills guide and the skills versus plugins comparison so you know what you are installing.
• Read discovering plugins before adding marketplaces.

Cheat Sheet

Frequently Asked Questions

Is SkillSpector free?

Yes. It is open source under the Apache-2.0 license. The optional LLM review uses a provider you pick, and that provider may charge you.

Do I need an API key to use it?

Not for the static scan we ran with --no-llm. The LLM mode needs credentials for a provider such as Anthropic or OpenAI, or a local model server.

Does a SAFE result mean a skill is safe?

No. It means the static patterns found nothing. Our bad skill still had hidden instructions the static scan did not report, so read the source too.

Can it scan a skill straight from GitHub?

The README says it accepts Git repository URLs, zip files, directories and single files. We scanned local folders only.

Will it work with other agents?

The README says skills for Claude Code, Codex CLI, Gemini CLI and MCP servers can be scanned. We only tested Claude Code skills.

Conclusion

SkillSpector is a quick, free first filter for Claude Code skills: it scored our clean skill 0 and our bad skill 100, and it named the risky lines in the script. It missed the hidden instructions in the skill text, so treat it as one layer, add a source review such as the bundled skill-inspector, and only then install. Run it in a throwaway folder, keep --no-llm unless you want a model involved, and make the scan a habit before every new skill.