SkillSpector: Scan Any Claude Skill for Malware Before You Install It
A free, open-source scanner from NVIDIA. Point it at a skill folder or GitHub link and it checks every file for 71 known attack patterns, then gives a 0-100 risk score and a plain answer: safe, caution or do not install
Claude skills run with a lot of trust: a skill is a folder of instructions and scripts that Claude follows and runs. NVIDIA's SkillSpector reads that folder before you install it and tells you whether anything inside looks dangerous. In NVIDIA's research set of 31,132 skills, 26.1% had a vulnerability and 5.2% showed likely malicious intent.
What it checks (from the README)
- 71 patterns in 17 categories, including prompt injection, hidden instructions, data exfiltration, stealing environment variables (API keys), privilege escalation, supply-chain risks and MCP tool poisoning.
- Two stages: a fast static scan, then an optional AI review of what the code and instructions actually do.
- Scans a folder, a single SKILL.md, a zip file or a GitHub link.
- Output: a risk score from 0 to 100, a severity (LOW to CRITICAL) and a recommendation: SAFE, CAUTION or DO NOT INSTALL, with the file and line of each finding.
Keep reading
Free, for an email.
Unlocks 3 more sections, 1 copy-paste prompt, the document version, and every other guide on the site, for free. Enter your email once to keep reading.
45,000+ follow where these guides come from.No spam. Unsubscribe in one click.