NVIDIA Finds Vulnerabilities in 26.1% of 31,132 Agent Skills

Of 31,132 Agent skills scanned, 26.1% were found to contain vulnerabilities and 5.2% showed signs of malicious activity. These findings come from NVIDIA's open-source SkillSpector project and show that the rapid expansion of Agent skills is hitting a trust bottleneck.

What this is

Here, a “skill” refers to a set of operating instructions and scripts that an Agent tool can load, typically packaged in a SKILL.md file. Unlike vetted npm packages, many skills can be installed simply by cloning a repository or copying text, with insufficient source review, version locking, and permission isolation.

SkillSpector checks 71 risks across 17 categories, including prompt injection, data exfiltration, privilege escalation, memory poisoning, and tool poisoning—the last of which means a malicious skill tampers with data returned by an MCP tool. MCP, the protocol that lets AI connect to external tools and data, solves the connectivity problem; it does not automatically review skill content.

Notably, GitHub's Trending list was dominated by skill repositories on the same day, while NVIDIA's SkillSpector and OpenAI's codex-security also ranked near the top. The simultaneous surge in supply and rising interest in security tools shows that developers and enterprises have begun to recognize a fundamental point: as the number of skills grows, the attack surface expands in parallel.

Industry view

We believe this is not fear-based marketing but necessary catch-up work after the mass adoption of Agent tools. Skills enable AI to perform more real-world tasks, but they can also read files, invoke APIs, and influence long-term memory. Once third-party instructions go unreviewed, the greater the permissions granted, the greater the potential loss.

There is, however, a counterargument: the 26.1% “vulnerability rate” reflects a specific sample and set of detection rules, and it does not mean the same proportion of skills are under active attack. Scanners can also produce false positives or false negatives, particularly during second-stage checks that rely on large language models to interpret meaning. More importantly, static scanning alone cannot fully identify malicious triggers, dynamically downloaded content, or post-execution behavior.

SkillSpector is therefore better suited to an entry-level security gate than to a guarantee of safety. Enterprises still need to limit skill permissions, isolate execution environments, and monitor runtime behavior. A “scan passed” label alone is not enough to justify deploying a high-risk task directly into production.

Impact on regular people

For enterprise IT: Skill libraries are becoming a new software supply chain. Enterprises should establish scanning, approval, version-locking, and tiered-permission mechanisms, especially for Agents that connect to code, email, financial systems, or customer data.

For individual professionals: Installing a skill may do more than add functionality; it also introduces unfamiliar code and operating instructions. When company repositories, account credentials, or business data are involved, users should prioritize trusted sources and scan skills before installation.

For the consumer market: One-click installation for mainstream users lowers the barrier to using AI tools, but security-review capabilities remain inconsistent. More reliable products in the future will likely integrate permission prompts, risk classification, and rapid revocation directly into the installation flow.