Agent skills are simple folders of plain‑English instructions that AI agents load when a task matches. Anyone can publish them, so they become a new software supply chain risk. A quick static scan can flag obvious malicious code, but the real danger lies in prose‑based prompt injection that a code‑only tool misses.

Running NVIDIA’s Skill Spector on three skills showed the scanner return a perfect 100 on a honeypot that correctly told the user to avoid installation, yet it also flagged 16 findings on a legitimate GitHub automation skill—most of which were simply the skill performing the advertised API calls. The single integer score cannot distinguish benign functionality from hidden threats, so a second pass is needed to filter false positives.

Industry scans reveal a high prevalence of injection: 26.1 % of 42,447 skills contain prompts that can hijack agents, and 5.2 % show likely malicious intent. Snyk’s February 2026 report found 36.8 % of 3,984 skills with at least one flaw, and Indonesia labs documented a real‑world prompt injection that leaked private repo details through a single sentence.

Skill Spector addresses this gap with four parallel analyzers—deterministic pattern matching, AST analysis, taint tracking, and a live CVE lookup—plus three LLM‑based judges that interpret prose. The tool is open source, free to run, and essential for verifying skills before deployment.