🔥 Hot Repo: 1-in-4 AI Agent Skills Are Backdoored — NVIDIA Fixed It

One-liner — SkillSpector is NVIDIA's open-source security scanner that audits AI agent skills for vulnerabilities, malicious patterns, and backdoors before you install them. - Repo: NVIDIA/SkillSpectorhttps://github.com/NVIDIA/SkillSpector - Stars: ⭐ 3,111 +811 today - Language: Python - License: Apache 2.0 --- What It Does SkillSpector runs a two-stage analysis on any AI agent skill: first, a fast static pass using AST analysis and pattern matching against 64 vulnerability templates across 16 categories; then an optional LLM-powered semantic sweep to filter false positives and explain findings in plain English. It accepts Git repos, URLs, ZIP archives, directories, or single files, and outputs risk scores from 0–100 with explicit install/reject recommendations. Why It's Blowing Up The AI agent skill marketplace has exploded — Claude Code, OpenClaw, Cursor, and a dozen other platforms now host thousands of community-built skills that drop into any developer's agent with a single command. The problem: NVIDIA's own research found 26.1% of skills contain exploitable vulnerabilities, and 5.2% show likely malicious intent. Snyk's parallel ToxicSkills study, scanning 3,984 skills on ClawHub, found 76 confirmed credential-stealing or backdoor payloads hiding behind normal-looking skill descriptions. NVIDIA shipped SkillSpector on May 22, 2026, alongside its Verified Agent Skills program — a catalog of 162 cryptographically signed skills, each passing a SkillSpector scan before publication. The timing is sharp: as skill marketplaces race for developer adoption, nobody was auditing the supply chain. SkillSpector fills that gap, and its jump to 3k+ stars in under three weeks shows the community already knows it. Key Features - Two-stage analysis — fast static AST scanning followed by optional LLM semantic evaluation for accuracy - 64 vulnerability patterns — 16 categories covering prompt injection, MCP tool poisoning, privilege escalation, and data exfiltration -