§1Installing a skill is running a stranger's code
An agent skill is a folder of instructions and scripts that your AI assistant loads and acts on. An MCP server is a process your agent is allowed to call. Both run with your agent's permissions, on your machine, against your data. Installing one is the same act as running npm install on a package you have never read: you are trusting code from a stranger. The difference is that almost nobody scans agent skills, and the base rate of bad ones is not zero. NVIDIA, who would know, put a quarter of the skills in their research set as carrying vulnerabilities and one in twenty as showing likely malicious intent.
So this week NVIDIA shipped SkillSpector, a scanner that reads a skill and tells you whether it is safe to install. It runs 71 patterns across categories like prompt injection, data exfiltration, privilege escalation and MCP tool poisoning, and gives you a risk score and a recommendation. It is a good idea and exactly the kind of plumbing the agent world has been missing. Before we recommended it to anyone, we did the obvious thing and turned it on ourselves.
§2What it said about our own fleet
We scanned 53 skills: the six we wrote ourselves plus the 47 bundled plugin skills that ship with the tools we run every day. Static analysis only, read-only, no model calls. The six we wrote came back clean, all cleared as safe. Then the scanner flagged 39 of the 53, put 23 on caution, and told us outright to not install 15 of them.
Here is the part that matters. Those 15 "do not install" verdicts were almost all official, vendor-published plugins. The skill that creates skills. The one for writing commands. The one for writing hooks. The one that documents plugin structure. Fifteen red flags on code shipped by the same people who ship the agent. If we had wired the scanner to block installs, it would have told us to tear out half the standard toolkit.
§3It flagged the safeguard as the threat
We read the findings instead of obeying them, and the best one is worth the whole exercise. One plugin picked up a high-severity prompt injection flag. We opened the file it pointed at. The flagged line was the skill defending itself against prompt injection: text warning the agent that a folder on disk might be named something like "ignore previous instructions" and instructing it to treat such strings as inert labels to print and nothing else. The scanner's signature for hidden instructions matched the example phrase quoted inside the defence. It flagged the guard as the attack.
Another plugin drew a data exfiltration flag. The evidence was its evaluation scripts reading environment variables and calling subprocess, which is what evaluation scripts do. Read config, spawn a process, run a check. The pattern that catches a real key-stealer also catches a perfectly ordinary tool doing its job.
§4Why a scanner cannot tell the difference
A pattern scanner cannot distinguish a skill that discusses a threat from one that commits it. A skill-authoring tool legitimately talks about executing code, reading configuration and spawning subprocesses, because teaching you to do those things safely is its entire purpose. A hook guide legitimately explains how hooks fire. All of it trips the same patterns a genuine attack would. The result is high recall and low precision: it catches the real threats, and it catches a pile of harmless code alongside them, and it cannot rank one above the other.
Anyone who lived through a decade of static application security scanners knows this shape. The tool floods the team with findings, most of them false, the team learns the output is mostly noise, and eventually everyone stops reading it. That is the failure mode to avoid here, and it rhymes with something we wrote about only yesterday: a confident automated decider that is wrong on the nuance, handing you a verdict with no signal for when to doubt it. A four-thousand-star repo is not safe because it is popular, and a red scanner verdict is not true because it is red.
§5Scan everything, trust the scan with nothing
None of this makes scanning wrong. Agent skills are code from strangers and you should absolutely run a scanner over anything new before it touches your system. The mistake is treating the output as a gate instead of a torch. A gate makes the decision for you, and this class of tool is not good enough to be trusted with that decision, as the fifteen false alarms on our own official plugins show. A torch shows you where to look, and then you decide.
So the rule we would give anyone adopting one of these is short. Run it on every new install. Read every finding yourself. Never wire it to auto-block, or it will happily block the vendor tools you depend on. Treat it as an adviser, not a judge, exactly as we said of the cheap model gate. Scan everything. Trust the scan with nothing. The reading is still your job.