NVIDIA's SkillSpector Lists 64, 68 or 71 Rules Depending on the Page

NVIDIA's SkillSpector, an Apache-2.0 scanner for AI agent skills, is described as having 64, 68 or 71 detection rules, depending on whether you read Help Net Security, NVIDIA's documentation or the repository README.

The README on GitHub lists 71 vulnerability patterns in 17 categories. NVIDIA's scanning agent skills page says 68 in 17. Help Net Security counted 64 in an Aug. 3 write-up by Senior Staff Writer Anamarija Pogorelec. None of the three says which version it counted, so the gap may be a tool that kept growing. GitHub showed 21,918 stars for the repository on Oct. 26.

What a scan covers, and what it never runs

A skill is a folder of instructions and scripts that a coding agent such as Claude Code or Codex loads, described by a SKILL.md file. The sort of skill in question includes the 450-line Cloudflare security audit skill The Terminal examined earlier, and the design skills in the hallmark and impeccable repositories.

You point skillspector scan at a directory, a zip file, a single SKILL.md or a Git URL. The README says it never executes the skill. The static pass walks the code's syntax tree, follows environment variables and file contents toward network calls, matches YARA malware signatures and runs regular-expression rules for prompt injection and credential access.

Dependency lists go to OSV.dev, a public vulnerability database. Offline, the README says the check falls back to a small built-in list.

How the 0 to 100 score is built

The README assigns points by severity and maps the total to a recommendation. Executable scripts get a 1.3x multiplier.

Score	Recommendation	Source
0 to 20	SAFE	README
21 to 50	CAUTION	README
51 to 100	DO NOT INSTALL	README

1. CRITICAL50 points
2. HIGH25 points
3. MEDIUM10 points
4. LOW5 points

Source: NVIDIA/SkillSpector README, accessed 2026-10-26

The arithmetic explains the README's own example. A skill that harvests environment variables and posts them to an outside server trips two HIGH findings, 25 points each, which total 50 and would sit at the top of the CAUTION band. The README rates that example DO NOT INSTALL. Applying the 1.3x multiplier for executable scripts gives 65, which crosses 50. That reading is The Terminal's arithmetic, not a sentence in the README.

NVIDIA's documentation page does not describe thresholds at all. It gives a triage policy instead: block critical and high findings, remove hidden instructions, fix dependencies.

The optional LLM pass and what leaves the machine

The second pass is a language model that confirms or disputes the static findings and writes explanations. The README says it never removes a deterministic finding. It also says file contents go to the configured provider unless you pass --no-llm.

Help Net Security reports that the pass needs an OpenAI-compatible endpoint and key, set through SKILLSPECTOR_PROVIDER, which defaults to NVIDIA's build.nvidia.com. NVIDIA's docs agree that semantic checks switch on only once a provider and key are set. Help Net Security reports that the project claims about 87 percent precision for the LLM pass. That is a project figure, and no independent party is named as having measured it.

The README describes the static pass differently: high recall, moderate precision. In practice that means a long list of flagged lines for a person to read.

What the README says it cannot do

The limitations list is short. SkillSpector is weak on non-English content, images, and encrypted or compiled code. The README calls it defense in depth and not a sandbox.

Help Net Security attributes a separate finding to a study at arXiv 2601.10338: skills that ship an executable script are 2.12 times more likely to be vulnerable. The 1.3x multiplier is NVIDIA's own weighting, and neither page connects the two numbers.

For continuous integration, the README lists exit code 0 for safe or caution, 1 for findings or failed gates and 2 for an error. It does not say how a CAUTION result that carries findings is classed. The repository was last pushed on Oct. 23.