What happened
NVIDIA released SkillSpector (Sept 8, 2026, Apache 2.0), an open-source scanner that detects vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risk in Claude Code, Codex CLI, Gemini CLI and MCP skills before installation; it underpins NVIDIA's 'Verified Skills' pipeline that scans, evaluates, and signs skills prior to catalog publication, citing research that 26.1% of skills contain vulnerabilities and 5.2% show likely malicious intent.
Why it matters
Agent 'skills' are an emerging, largely unvetted supply-chain surface analogous to npm/PyPI packages; a major AI infra vendor shipping a free scanner plus a signing pipeline sets a reference architecture other agent-skill marketplaces (e.g., OpenClaw already integrating it) are adopting.
Applicability
Teams building or distributing Claude Code/Codex/Gemini CLI skills or MCP tools should integrate SkillSpector into CI/install-time gating now.