NVIDIA has introduced SkillSpector, an open-source security scanner designed to vet AI agent skills—such as those used by Claude Code and Gemini CLI—before installation. Addressing the high risk of implicit trust in these skills, research on a 31,132-skill dataset revealed that 26.1% contain vulnerabilities and 5.2% exhibit malicious intent. SkillSpector employs a two-stage analysis process consisting of fast static analysis followed by optional LLM-based semantic evaluation. The engine detects 71 distinct vulnerability patterns across 17 categories, including prompt injection, data exfiltration, supply chain risks, and dangerous code execution via AST analysis. It also features live vulnerability lookups via SC4 queries to OSV.dev for real-time CVE data. The tool supports multiple input formats, including Git repositories, URLs, and ZIP files, while enforcing resource bounds like a 100 MiB per-ingest cap to prevent zip bombs. Results are delivered in Terminal, JSON, Markdown, or SARIF formats, with a risk score ranging from 0–100 used to categorize safety levels. Furthermore, SkillSpector can function as a Model Context Protocol (MCP) server, allowing agents to use scanning as a runtime guardrail to gate installations.