NVIDIA SkillSpector: Security Vulnerability Scanner & Benchmark for AI Agent Skills & MCP Tools
An authoritative open-source security scanner and capability benchmark for AI agent skills and MCP servers from NVIDIA, with 22k+ GitHub stars. As autonomous coding and desktop agents gain widespread MCP tool access, indirect prompt injection, tool poisoning, sensitive credential theft, and supply-chain vulnerabilities pose severe enterprise threats. SkillSpector offers static AST analysis, adversarial fuzzing, runtime sandbox interception, and least-privilege permission auditing. It evaluates any candidate MCP server or skill bundle before installation, producing actionable risk scores, vulnerability proofs, and hardening remediations.
As autonomous AI agents acquire shell execution, filesystem, and network privileges, unvetted skills and MCP tools expose organizations to disastrous supply-chain attacks. NVIDIA SkillSpector establishes the definitive standard for AI tool security verification before production deployment.
Step-by-Step Action Checklist
0 / 4 CompletedI am integrating NVIDIA SkillSpector to establish a robust security gate for our enterprise Claude Code and MCP agent infrastructure. Please provide: 1) [SkillSpector Batch Audit CLI Script]: Python script demonstrating automated traversal and security scoring of local MCP repositories with CVSS-ranked JSON outputs; 2) [Indirect Prompt Injection Test Suite]: Three realistic adversarial test vectors (embedded webpage payloads, credential exfiltration via tool params, path traversal attempts) to validate defense coverage; 3) [Automated CI/CD Quality Gate]: GitHub Actions workflow file that triggers SkillSpector checks on every PR touching agent tool definitions, failing builds on critical findings.