NVIDIA has released SkillSpector, an open-source scanner that evaluates AI agent skills and determines whether they should be installed. It can analyze a directory, zip file, a single SKILL.md, or a Git URL, returning findings, a risk score, and recommendations. The tool’s first pass is static and takes seconds, using an AST walk to flag exec, eval, subprocess, and dynamic imports, a taint tracker for environment variables and file contents, YARA rules for known malware, and regex analyzers covering 64 detection patterns. Dependency checking queries OSV.dev for known CVEs, with results cached for an hour and a built-in fallback for air-gapped runs. An optional second pass, off by default, uses an LLM via an OpenAI-compatible endpoint to reduce false positives, achieving roughly 87% precision. Each finding adds points, with anything past 50 on the scale resulting in a "do not install" recommendation; executable content multiplies the result by 1.3. The study behind the tool found skills that ship a Python script are 2.12x more likely to be vulnerable. Output includes a score, file list, and findings with line numbers and confidence figures, available in terminal, JSON, Markdown, and SARIF formats. The --no-llm flag skips the second pass but still reaches the network for OSV.dev lookups.