NVIDIA SkillSpector is a free, open-source scanner that checks a Claude Code skill for 17 kinds of risk before you install it and hands back a score from 0 to 100, where anything over 50 means do not install. You feed it a skill folder, a GitHub link or a zip, it reads the files without ever running them, and it flags things like prompt injection, data exfiltration and tool misuse. The reason to bother is simple: if your Claude Code is packed with skills and plugins, one bad skill could leak your API keys, and a January 2026 study found about 1 in 4 marketplace skills had at least one security flaw. The reel below shows the install, a real scan and how to read the score. The presenter in the reel is an AI avatar of Hammad; the words and facts are his.
Why Claude Code skills need scanning: the numbers
The study behind the reel is 'Agent Skills in the Wild' by Yi Liu and co-authors, arXiv 2601.10338, published on 15 January 2026. The authors are academics, not NVIDIA. They collected 42,447 skills from two marketplaces, analysed 31,132 with their own detector, and found 26.1% had at least one vulnerability. Data exfiltration showed up in 13.3% and privilege escalation in 11.8%. A further 5.2% showed high-severity patterns strongly suggesting malicious intent, which is a pattern match, not confirmed malware. The follow-up paper from the same lead author, arXiv 2602.06547, checked 98,380 skills and confirmed 157 as malicious, about 0.16%, and the registries removed all of them. So confirmed malware is rare, sloppy and risky skills are not, and Anthropic's own advice is to use skills only from sources you trust.
What NVIDIA SkillSpector checks
SkillSpector lives at github.com/NVIDIA/SkillSpector under the Apache-2.0 licence, with 23,757 stars and a v2.13.2 release dated 28 October 2026 when I checked on 1 November 2026. It is Python, needs Python 3.12 or newer, and its pattern catalogue covers 17 categories, including prompt injection, data exfiltration, privilege escalation, supply chain, tool misuse, memory poisoning, MCP least privilege and MCP tool poisoning. The static stage always runs: regex analysers, Python AST checks for exec, eval and subprocess calls, taint tracking from secrets or files to network calls, YARA rules for malware and cryptominers, unicode tricks and hidden HTML comments, and a live CVE lookup on OSV.dev. An optional second stage asks an LLM of your choice to judge intent. The exact pattern count differs between the README and the NVIDIA docs page, so I do not quote one.
Install SkillSpector from NVIDIA's GitHub, not PyPI
Install uv, then run: uv tool install git+https://github.com/NVIDIA/skillspector.git. If the only Python on your machine is 3.14, add --python 3.12 to that command. It is not on PyPI or npm, so treat any pip install skillspector package that appears as a possible typosquat until NVIDIA links to it. If you want Claude Code to call it as a tool, register it with claude mcp add skillspector -- skillspector mcp, but the CLI is the reliable path, so test the MCP route before you depend on it.
Scan offline with --no-llm
To scan one skill: skillspector scan ./my-skill --no-llm. To scan everything you already have installed: skillspector scan ~/.claude/skills --recursive --no-llm, which looks one level deep for every subfolder with a SKILL.md. Before installing a new skill, point it at the GitHub link or the zip instead of a folder. The --no-llm flag keeps the static stage only, so the contents of the skill never leave your machine; the one exception is that dependency names and versions still go to OSV.dev for the CVE check. Use it for private or client skills, because the LLM stage sends file contents to whichever model provider you configure. Claude Code or Codex can run these commands for you if you ask.
ONE TACTIC A WEEK
How to read the risk score
The score runs from 0 to 100 and higher means riskier. Each finding adds points: 50 for critical, 25 for high, 10 for medium, 5 for low, and skills with executable scripts get a 1.3x multiplier. The bands are 0-20 low (safe), 21-50 medium (caution), 51-80 high (do not install) and 81-100 critical (do not install). On 24 October 2026 I ran v2.12.0 offline on the repo's own test fixtures: safe_skill scored 0 out of 100 with no findings, and malicious_skill scored 100 out of 100 with 7 findings, including a harmful instruction, environment variable harvesting and external transmission. The bundled skill-inspector skill, which wraps the scan in a manual source review, explicitly says not to rely on the number alone.
What SkillSpector cannot see
A low score means no known red flags fired. It does not mean the skill is safe. In the same offline test, the repo's four natural-language attack fixtures scored between 0 and 7, so static scanning missed them; the LLM review stage exists for those, at the cost of sending the files to a provider. The documented blind spots are text inside images, encrypted or binary code, non-English content and anything that only shows up at runtime. The README calls the tool defence in depth, not a sandbox: it never runs the skill and it does not isolate a skill you install anyway. Treat it as one layer, alongside reading the SKILL.md yourself and checking what allowed-tools a skill grants.
My safe rule for Claude Code skills
Scan every skill before you install it, keep the scan offline with --no-llm, and treat a low score as no red flags found, not as safe. It takes seconds per skill and it is free, so there is no good reason to skip it.
Get the setup guide
The free guide at withhammad.com/resources/skillspector-scan-skills has the install commands, the offline scan commands, the score table and the test results. On Instagram, comment SCAN on the reel and the guide link arrives by DM (follow @withhammad.ai first so the DM reaches you).
Related reading
If this is useful, see 27 free Claude installs for LinkedIn and the YouTube agent skill for Claude.