I ran NVIDIA's new skill scanner on my own library. It told me not to install … · @ReignSwords · TwKit

@ReignSwords

I ran NVIDIA's new skill scanner on my own library. It told me not to install my own skills. I've installed 75 agent skills this month. Sentence Transformers, ECC, ponytail — all of them run with implicit trust on my machine. NVIDIA's open-source SkillSpector scans skills before you install them. Their number: 26.1% of 31,132 skills carry vulnerabilities. 5.2% look outright malicious. So I pointed it at my own library. 89 seconds to install. 4 minutes 26 seconds to scan 32 of my 75 skills. The other 43 never got scanned — the tool caps out at 32 per run. Verdict: DO_NOT_INSTALL. 363 findings. Two skills scored 100/100 CRITICAL. A third hit 85. Then I read the actual findings. The scanner is half wrong. The one fair catch: over 200 unpinned npx calls. `npx -y bun`, `npx playwright`, `npx tsx` — no version pinned anywhere. One bad package release and every fresh install pulls it. That's real. That's the fix I'm making today. The rest is noise with a scary label. "Credential Access" because a doc tells you to put a token in .env. "Tool Parameter Abuse" because an uninstall guide says rm -rf ~/. "Chaining Abuse" because an install step runs sudo apt-get update && sudo apt-get install ffmpeg. My skills aren't malicious. They're just powerful. And the scanner can't tell the difference — it fails closed, on purpose. That's the real lesson. There is no clean skill scan. Anything useful enough to install is dangerous enough to flag. The question was never "is it clean." It's "do you know what it can do." I didn't. Until this morning. When did you last read a skill before installing it? Be honest. I'm working through the other 43 by hand this week — follow along if you want the list. 🔵 Fellow Premium members, let's connect! I post about AI & tech — follow for more 👥

曝光 97 · 评论 9 · 点赞 1 · 书签 0