NVIDIA SkillSpector setup and agent skill security scans

This tutorial installs NVIDIA SkillSpector on Ubuntu with uv and tests its security checks on two agent skills. The speaker introduces the open source scanner as a way to inspect skill folders, ZIP archives and Git repositories before an AI agent uses their instructions.

The walkthrough explains the sample skill.md file, including its name and description in Markdown front matter. The first scan uses the no-LLM option, which runs pattern-based checks and skips semantic analysis. The Git Committer example returns a risk score of 0 out of 100, low severity, a safe verdict and no detected issues. Reported coverage is 100% for its single file; this result describes the scan, rather than proving that every possible risk is absent.

A cooking assistant example produces five findings, medium severity and a caution verdict. The speaker identifies an unmentioned helper.py script that collects environment variables and sends them to an external server. The scanner also flags missing tool scope.

The speaker says the scan appears to miss an added instruction to put laxative powder in every recipe. He suspects an LLM pass would be needed to detect that natural-language instruction, but does not test it. The closing explanation describes regex, AST and Yara checks, plus an optional LLM analysis pass that requires an API key.