# AI use cases for Skill Spector (NVIDIA/SkillSpector) Repo: [NVIDIA/SkillSpector](https://github.com/NVIDIA/SkillSpector) | Use cases: 3 | Page: https://dedupedai.com/use-cases/nvidia-skillspector/ SkillSpector is NVIDIA's security scanner for AI agent skills used by Claude Code, Codex CLI, Gemini CLI and others. It scans Git repos, URLs, zips, directories or single files for 71 vulnerability patterns in 17 categories, including prompt injection, data exfiltration and MCP tool poisoning, with fast static analysis plus optional LLM evaluation, live OSV.dev CVE lookups, a 0 to 100 risk score and Terminal, JSON, Markdown or SARIF reports. This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL. - Scan an agent skill for prompt injection and exfiltration before installing: https://dedupedai.com/use-cases/nvidia-skillspector/scan-an-agent-skill-before-installing/ - Gate skill updates in CI so only new findings fail: https://dedupedai.com/use-cases/nvidia-skillspector/gate-skill-changes-with-a-baseline/ - Spot new or changed MCP servers between registry snapshots: https://dedupedai.com/use-cases/nvidia-skillspector/compare-mcp-registry-snapshots/ ## How to scan an agent skill for prompt injection and exfiltration before installing with Skill Spector Repo: [NVIDIA/SkillSpector](https://github.com/NVIDIA/SkillSpector) | Difficulty: Beginner | Time: 10 minutes | Basis: From the README Run Skill Spector on a skill directory or repo and read its risk score and findings first. **Who it is for:** A developer about to install a community skill into Claude Code or Codex. **The problem:** Skills run with implicit trust; the README cites research where 26.1% of analyzed skills had vulnerabilities and 5.2% showed likely malicious intent. **The outcome:** A 0 to 100 risk score with severity labels and findings, so you decide whether to install. ### Steps 1. Install with `uv tool install git+https://github.com/NVIDIA/skillspector.git` 2. Download or clone the skill you want to check 3. Scan it without LLM costs using Docker: `docker run --rm -v "$PWD:/scan" skillspector scan ./my-skill/ --no-llm` 4. Read the risk score, severity labels and recommendations 5. Install the skill only if the findings are acceptable ### Prompt to paste into your agent ```text Use NVIDIA/SkillSpector to scan the skill at before I install it. Run static analysis only, then summarize the risk score and each finding in plain words, and recommend install, review or reject. ``` ### Caveat A clean scan lowers risk but is not a guarantee; static analysis cannot prove a skill is safe. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/nvidia-skillspector/scan-an-agent-skill-before-installing/ ## How to gate skill updates in CI so only new findings fail with Skill Spector Repo: [NVIDIA/SkillSpector](https://github.com/NVIDIA/SkillSpector) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README Accept known findings into a baseline and re-scan so each update surfaces only new issues. **Who it is for:** A platform team maintaining an internal skills library that changes every week. **The problem:** Re-scanning the same accepted findings every time buries the new, real problems. **The outcome:** A committed baseline file and scans that report and score only new findings. ### Steps 1. Install Skill Spector as above 2. Accept current findings once with `skillspector baseline ./my-skill/ -o .skillspector-baseline.yaml` and commit it 3. On each change run `skillspector scan ./my-skill/ --baseline .skillspector-baseline.yaml` 4. Review suppressed findings occasionally with --show-suppressed 5. Exclude test fixtures with --exclude patterns where needed ### Prompt to paste into your agent ```text Set up NVIDIA/SkillSpector for : create a baseline of the current findings, commit it, and add a CI step that scans against the baseline and fails on any new high-severity finding. ``` ### Caveat Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/nvidia-skillspector/gate-skill-changes-with-a-baseline/ ## How to spot new or changed MCP servers between registry snapshots with Skill Spector Repo: [NVIDIA/SkillSpector](https://github.com/NVIDIA/SkillSpector) | Difficulty: Advanced | Time: 30 minutes | Basis: From the README Scan two MCP registry captures and get a comparison of added, removed and changed servers. **Who it is for:** A security engineer watching an MCP registry for new or modified servers. **The problem:** Registries change silently, and a modified server version can slip into use unnoticed. **The outcome:** A JSON report listing added and removed server identities and changed fields between two captures. ### Steps 1. Capture the registry payload before and after as registry-before.json and registry-after.json 2. Scan the first: `skillspector scan registry-before.json --mcp-registry --format json --output previous.json` 3. Scan the second with --mcp-registry-compare previous.json and write compared.json 4. Read the comparison object: added, removed, changed and unchanged_count 5. Inspect raw records for anything under unmodeled_changes ### Prompt to paste into your agent ```text Using NVIDIA/SkillSpector registry mode, scan registry-before.json, then compare registry-after.json against it, and give me a table of added, removed and changed MCP servers with the fields that changed. ``` ### Caveat A server absent from the current input is reported as removed, which does not prove it was removed from the registry. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/nvidia-skillspector/compare-mcp-registry-snapshots/