Expired50% confidenceFactExact time
SkillSpector primarily performs static content analysis and does not actually execute Skills; therefore, it cannot detect malicious code in binary/encrypted content, risks in non-English content, or dynamic malicious behavior at runtime.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
7/2/2026
First Seen
This claim has expired. It is kept for the record and no longer describes the current state.
Valid until: 9/30/2026(expired)
Sources
SkillSpector: NVIDIA's Open-Source Security Scanner for AI Agent Skills
bilibiliAIlazy俊6/19/2026
Related Claims
UnverifiedDirectly executing Skill code downloaded from the internet or autonomously generated by an agent in the host environment poses security risks, as it may contain dangerous operations such as deleting files, accessing sensitive directories, or launching network attacks.69% similarUnverified现有文档安全扫描工具主要检查宏代码、嵌入对象和外部链接等已知威胁向量，几乎没有工具会审查空格字符的渐变色标点参数是否携带编码数据69% similarUnverified面对运行时动态加载的恶意代码，代码审查和静态扫描等传统安全手段几乎完全失效68% similarUnverified发现恶意依赖被安装并不能证明恶意代码真的运行过，命中查询工具应被视为深入调查的理由而非入侵结论68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/41759API
curl https://kongchang.com/api/v1/knowledge/claims/41759MCP
get_claim(id=41759)