Check your
AI skills.

A skill is a package of instructions that helps an AI agent perform a task. It often starts with SKILL.md and can include scripts, templates, reference files, and dependencies. Claude Code can load relevant skills or let you invoke them directly.

A skill may cause harm through ordinary-looking instructions as well as executable code. For example, a document-formatting skill has no clear reason to collect your login tokens or send your whole home folder to a server.

Where SkillSpector fits

NVIDIA’s SkillSpector checks skill inputs for suspicious patterns and can add an AI-assisted review. The scanner analyzes content without running the target skill. It accepts local folders, individual files, ZIP files, and repository URLs.

A finding is evidence to investigate, not proof of malware. Equally, no findings means no detected issues within the checks that completed. It does not prove that every dependency, future download, or runtime action is safe.

Start in your browser and file manager. You do not need to load the unknown skill into Claude Code to review it.

1. Check the source. Confirm the repository owner and exact URL. Read its description, license, recent changes, and issues. Popularity is useful context; it is not a security verdict.
2. Create a review folder. Make a folder such as skill-review outside your normal projects and outside Claude’s active skill folders.
3. Download for inspection. On GitHub, use Code → Download ZIP, or keep a supplied ZIP for the scanner. Downloading source does not require running its installer.
4. Preserve the complete package. If extracting a ZIP, find the folder containing SKILL.md and retain its scripts and references. Do not review only the headline file when the skill includes more.
5. Record what you received. Keep the source URL, download date, and commit or release when available. Review that same copy before using it.

A useful folder layout

skill-review/
  candidate-skill/       ← the downloaded skill
    SKILL.md
    scripts/
    references/
  reports/              ← your scan results

Leave the candidate out of ~/.claude/skills/ and .claude/skills/ until your review is complete. Those are personal and project skill locations. A staging folder is only organization; it does not isolate code if you choose to execute it.

Open Terminal on macOS/Linux or PowerShell on Windows. Run the commands here in your shell. This HTML guide does not scan files itself.

1. Check the prerequisites

You need Git and uv, a Python tool manager. Use the official installation links in the source appendix if either is missing. The checked SkillSpector package requires Python 3.12–3.15; this guide selects 3.12.

git --version
uv --version

Both commands should print a version. If a command is missing, finish its official setup and reopen your terminal before continuing.

2. Install SkillSpector from NVIDIA’s repository

uv tool install --python 3.12 git+https://github.com/NVIDIA/skillspector.git
uv tool update-shell

This installs the scanner and its dependencies in a tool environment. It does not install the candidate skill. It requires an internet connection, and uv may download Python if a compatible version is unavailable.

3. Reopen the terminal and verify

skillspector --help
skillspector scan --help

You should see command help, including scan and --no-llm. Record the installed version from the tool’s output or uv tool list with your reports. The repository can change; installed help is the best check for supported flags.

If setup does not work

“Command not found”: reopen the shell after uv tool update-shell. Python or dependency build error: confirm the selected Python version and read NVIDIA’s current installation notes. Unknown option: check skillspector scan --help for your installed version. Avoid running repeated administrator commands to work around an unexplained error.

Cost: SkillSpector is open source. The static workflow below needs no AI API key. An optional hosted AI review can incur provider charges.

Navigate into the review folder you created. Type cd followed by its path in quotes. For example, cd "/your/path/skill-review". Replace example paths with your own; spaces in paths need quotes.

Start with the complete local skill

skillspector scan "./candidate-skill/" --no-llm

scan selects the action. The path selects the material to review. --no-llm skips AI analysis, so the first pass does not send skill contents to a model provider. Read the terminal output through to the end, including skipped checks or coverage warnings.

Other supported inputs

# A ZIP file, without running its contents
skillspector scan "./candidate-skill.zip" --no-llm

# A public Git repository: replace owner and repo
skillspector scan "https://github.com/OWNER/REPO" --no-llm

# A single instruction file: narrower coverage
skillspector scan "./candidate-skill/SKILL.md" --no-llm

A single-file scan is useful for a quick look, but it is not equivalent to inspecting bundled scripts. If a repository contains multiple skills, review each relevant skill folder; do not assume one root scan covers every nested skill.

Save a report you can read later

On macOS/Linux, create the reports folder first, then run:

skillspector scan "./candidate-skill/" --no-llm --format markdown --output "./reports/candidate-review.md"

For native Windows, the checked version’s secure --output file writing is unavailable. Redirect standard output to a file in your own review folder instead:

skillspector scan "./candidate-skill/" --no-llm --format markdown > "./reports/candidate-review.md"

Reports can quote suspicious source material. Open them in a plain text viewer and treat quoted commands as evidence. Keep reports private if the skill contains proprietary content.

Optional: add an AI-assisted second pass

After reviewing the provider’s privacy and billing terms, configure a supported provider using NVIDIA’s instructions in the source appendix, then run the same scan without --no-llm. This can compare a skill’s claims with its apparent behavior. File contents eligible for analysis go to the configured provider; keep secrets out of the candidate. Confirm the report shows that AI analysis actually ran.

Read the recommendation and each finding together. A score is a summary of the scanner’s signals, not a percentage probability that you will be hacked.

For every finding, answer four questions

1. Where is it? Open the reported file and line, and read the surrounding function or paragraph.
2. What can it access or change? Identify files, environment variables, commands, accounts, and network destinations.
3. Does that fit the stated purpose? An upload may be expected in a publishing skill and surprising in a local formatter.
4. What would resolve it? Remove unnecessary behavior, narrow access, fix a dependency, or choose another skill. Ask a maintainer for evidence if you cannot explain it.

An example of a useful review note

False positives are possible. A scanner may flag educational examples or legitimate network features. Investigate the context instead of deleting warnings or generating a suppression baseline just to obtain a cleaner score.

A completed command is not always an approval

In the checked version, default exit code 0 includes both SAFE and CAUTION. Exit code 1 can indicate a risk threshold or an enabled strict gate; 2 indicates an error. Always read the report.

For a stricter repeatable review, the following flags request failure for any active finding or incomplete analysis. “Failure” here means the command returns a nonzero status; it does not install, delete, or repair the skill.

skillspector scan "./candidate-skill/" --no-llm --fail-on-findings --fail-on-incomplete

These flags are useful guardrails, but they still cannot detect every malicious behavior. Inspect coverage details even when the command succeeds.

Use this pass to connect the skill’s advertised job to the files you would actually give it. You do not need to understand every line to notice unrelated access or hidden behavior.

Two signals worth understanding

Downloaded code that runs immediately: an install command can fetch a script whose contents change later. Review the actual source and version rather than trusting a one-line command in a README.

Instructions to hide activity: a skill that asks an agent to conceal uploads or suppress warnings conflicts with an informed review. Keep it inactive while you investigate.

If you use an AI assistant to explain files, give it the review prompt in Appendix A. Use a separate session with no sensitive project files, limited tools, and manual permissions. AI review can help explain evidence; it does not replace your decision or guarantee protection from prompt injection.

When the report and manual review are acceptable, test the reviewed version with the least access needed for a harmless task.

1. Use a disposable project. Include dummy documents or test data. Keep credentials, personal files, and production accounts out of it.
2. Install only the reviewed skill. For a normal folder-based Claude Code skill, copy the directory containing SKILL.md into that test project’s .claude/skills/ folder. Keep its supporting files together. Do not substitute an unreviewed installer.
3. Choose Manual permissions. Read proposed commands and file changes. Decline unrelated uploads, privilege changes, or broad access.
4. Enable supported isolation. Claude Code’s shell sandbox can restrict files and network access. Its coverage does not include every tool: file tools, hooks, and MCP servers have separate boundaries. Check your environment’s documentation.
5. Try one narrow task. Compare the requested work with the actual output, file changes, and network requests you can observe.
6. Keep a decision record. Note the source version, scanner version, date, report, unresolved limits, and why you accepted or rejected it.

Keep a new skill project-scoped while you learn how it behaves. Avoid giving it administrator access, production credentials, or automatic approval of every command during its first test.

If the skill is already installed

Pause new sessions that might use it. Preserve a copy for review, then remove or disable its active installation using the mechanism that installed it. For a personal folder skill, its active location is commonly ~/.claude/skills/; for a project skill, .claude/skills/. Start a fresh session after changing the installation.

Scan the preserved copy. Removing a skill does not reverse actions it already took. If you find evidence that a credential was exposed, revoke or rotate that credential through its provider and review relevant account activity. A scan result alone does not establish that compromise occurred.

Use this checklist for each candidate. The counter tracks completed review steps; it is not a safety score. Your browser may remember selections on this device. Use Reset for a new skill.

Recheck when the inputs change

A scan describes one version at one point in time. Repeat it after changes to the skill, bundled scripts, permissions, or dependencies. Keep your earlier report so you can compare the changes.

For a collection of skills, the checked CLI supports --recursive, which discovers immediate child skill directories. It has limits and can leave coverage incomplete. For a beginner’s review, scanning each chosen skill folder separately makes the scope easier to verify.