中文版

SkillSpector（GitHub：https://github.com/NVIDIA/SkillSpector ，2026-03-21 创建，已 22,194★）是英伟达开源的 AI agent 技能安全扫描器，专门检测技能（skills）里的漏洞、恶意模式和安全风险。

背景很现实：现在人人都在给 Claude Code、Codex 这类 agent 装第三方技能，技能本质上是能读写文件、能跑命令的指令加脚本——装到一个带后门的技能，等于把电脑的钥匙交出去。SkillSpector 就是装之前先扫一遍的那道关。

为什么值得了解

• 技能生态涨得越快，供应链风险越大；”先扫描再安装”会很快变成默认习惯
• 英伟达官方出品，在 Agent 安全这个新方向上是有分量的信号
• 昨天聊的 Karpathy 版 CLAUDE.md 解决”AI 怎么写代码”，这个解决”给 AI 装的东西干不干净”，是同一枚硬币的两面

English Version

SkillSpector (GitHub: https://github.com/NVIDIA/SkillSpector , created 2026-03-21, now 22,194★) is NVIDIA’s open-source security scanner for AI agent skills, built to detect vulnerabilities, malicious patterns, and security risks inside skills.

The backdrop is practical: everyone is installing third-party skills into agents like Claude Code and Codex, and a skill is essentially instructions plus scripts that can read/write files and run commands — installing a backdoored one hands over the keys to your machine. SkillSpector is the checkpoint that scans before you install.

Why it’s worth knowing

• The faster the skill ecosystem grows, the bigger the supply-chain risk; “scan before install” will soon be the default habit
• An official NVIDIA release is a weighty signal in the new field of agent security
• Karpathy’s CLAUDE.md (covered yesterday) addresses “how AI should write code”; this one addresses “whether what you install into AI is clean” — two sides of the same coin