NVIDIA SkillSpector 1.0.0 scanned a directory of synthetic AI skills and flagged the invoice-sync agent as high risk. The tool identified critical vulnerabilities including hardcoded credentials, insecure remote code execution, and persistent memory injection within a single Python script.
Setting up the test environment
The workflow begins by creating a local folder named skill_market. This directory holds four distinct agent packages: a clean PDF summarizer, a repository janitor, a malicious invoice sync tool, and a notes MCP server. The PDF summarizer only reads local files. The janitor has broad permissions but operates on code repositories. The invoice sync tool is designed to exfiltrate environment variables and SSH keys. The notes MCP server attempts to read AWS credentials and pass them to external endpoints.
Each package contains a SKILL.md file, a requirements.txt list, and Python or Bash scripts. The invoice-sync directory includes an executable setup.sh that downloads and runs a remote installer. It also contains a sync.py script that sends a JSON payload to an invalid domain. That payload includes the full environment dictionary and the contents of the user’s private SSH key.
The Python code imports the skillspector module. If the library is not present, the script installs it from GitHub. It then calls the detect_skills function to list the agent directories found in the root folder. The output confirms that the scanner recognised all four packages.
Running the security scan
The scan function accepts a path to a skill directory and optional parameters for LLM analysis or baseline suppression. It invokes the default LangGraph workflow and returns a state dictionary. The code then extracts the active findings from the result. These are the issues that contributed to the final score after the system applies baseline suppressions.
Running the scanner against the invoice-sync folder produces a risk score of 85 out of 100. The severity level is high. The recommendation is to block deployment. The output lists 12 active findings across multiple components. One finding highlights the use of shell=True in a subprocess call. Another points to the hardcoded endpoint URL in the sync function.
The scanner also detects the presence of executable scripts. It flags the setup.sh file as a potential persistence mechanism. The notes-mcp server triggers a finding related to credential dumping. The tool reads the ~/.aws/credentials file and passes the contents to a tool definition without sanitising the input.
Aggregating fleet data
The code loops through every directory in the root folder. It runs the scan function on each one and stores the result in a fleet dictionary. It then builds a pandas DataFrame for each skill. This table contains the rule ID, category, severity, confidence score, file path, and line number for every finding.
A final summary DataFrame aggregates the data. It lists the skill name, risk score, severity, and recommendation for each agent. The list sorts the agents by risk score in descending order. The invoice-sync tool appears at the top with a score of 85. The notes-mcp server follows with a score of 70. The janitor and PDF summarizer show low scores.
The script prints a cross-tabulation of findings by severity. It then groups the results by rule ID to show the most common issues. The top rules include insecure remote execution and hardcoded secrets. The analysis completeness metric for the invoice-sync agent shows that the scanner covered all relevant files.
What it means
Developers can now run this pipeline as part of their continuous integration process. The CI policy gates stop builds if the risk score exceeds a set threshold. Teams can add custom YARA rules to catch organisation-specific threats. The system generates SARIF reports that integrate with other security tools. This framework allows teams to inspect agent skills before they reach production environments.
