SkillSpector finds risky skill code. You still need an install verdict.
NVIDIA's SkillSpector is a useful static scanner for AI-agent skills. Agent Skill Safety Kit is the human/agent-readable review workflow around it: permission boundaries, memory policy, receipts, exceptions, eval evidence, rollback, and the final launch decision.
Last updated: 2026-09-18. This is a practical comparison, not a vendor attack. If you run high-authority agent skills, use scanners and review contracts together.
Use SkillSpector when you need static analysis of a skill package. Use Agent Skill Safety Kit when you need to decide whether that package should be installed, listed, sold, delegated, sandboxed, or rejected.
Open the free kit Run the scorecard Validate a permission manifestWhere each tool fits
| Question | SkillSpector | Agent Skill Safety Kit |
|---|---|---|
| Does the package contain suspicious instructions, scripts, dependencies, or known risk patterns? | Strong fit. Static rules, code/taint analysis, dependency checks, optional semantic review, and SARIF-style reporting are scanner territory. | Uses scanner output as evidence, but does not replace deterministic code/security scanning. |
| What may this skill read, write, remember, trigger, message, spend, or change? | Can flag risky patterns, but it does not define the operating contract for the skill. | Primary fit. The permission manifest and review kit force explicit read/write/action/memory boundaries. |
| Can a marketplace or internal registry explain why a skill was approved? | Produces findings, but approval rationale still needs policy and disposition. | Primary fit. Produces a verdict: install, install with limits, ask for changes, reject, or paid/manual review. |
| Will the skill leave receipts and support rollback if an agent acts? | Can identify missing/unsafe code patterns, but receipt schemas and rollback expectations are governance artifacts. | Primary fit. Requires receipt fields, before/after state, exception behavior, and rollback notes. |
The combined workflow I would actually use
- Pin provenance: source URL, commit/hash, vendor identity, version, and declared install scope.
- Scan: run SkillSpector or an equivalent scanner before letting the package touch secrets, files, browsers, SaaS, or memory.
- Write the permission manifest: exact allowed reads, writes, tools, memory updates, outbound actions, spend, and human approval gates.
- Score the skill: use the browser-local Agent Skill Safety Scorecard to check identity, inputs, authority, outputs, receipts, memory, exceptions, evals, rollback, and portability.
- Disposition findings: for each scanner finding, record fix / suppress-with-reason / sandbox / reject.
- Decide launch verdict: install, install with limits, ask for changes, or reject. Do not let “no critical scanner findings” silently become “safe enough.”
Why this matters for marketplaces and teams
A skill can steer an agent that already has file, browser, SaaS, message, memory, or workflow authority.
A risk score does not define business approval, exception paths, human checkpoints, or rollback.
Buyers and internal teams should see scope, permissions, eval evidence, receipts, and a launch verdict before install.
Free artifacts
- Agent Skill Safety Kit — free review workflow and downloadable package.
- Agent Skill Safety Scorecard — browser-local 100-point readiness check.
- Permission Manifest Template — define authority before delegation.
- Permission Manifest Validator — locally validate manifest completeness.
- Sample Mini-Report — what a concise review verdict looks like.
If a skill has real browser/file/SaaS/customer/memory authority and the free review exposes gaps, use the $29 Custom Agent Audit Mini-Report for a short redaction-friendly review. For low-authority skills, the free kit is enough.