Agent security: scan skills before you install them
Installing third-party skills and plugins means installing code in your agent. NVIDIA released a scanner to catch the malicious ones.
The skills boom has a less-discussed side: every third-party skill or plugin is code that enters your agent and your machine. With marketplaces growing fast, the risk of malicious instructions or data exfiltration stops being theoretical.
The most concrete answer came from NVIDIA with SkillSpector, described in the videos as a kind of antivirus for skills: it scans for dangerous patterns and vulnerabilities before your agent loads the skill. It is the first serious piece of security hygiene for this ecosystem.
The advice is the same as with any dependency: do not run other people's code without reviewing it. Treat skills as third-party packages, pin versions, check the source and scan them. Installing with one command does not change the basic supply-chain rules.
Tools mentioned
Sources
More topics