TL;DR
Open-source scanner developed by NVIDIA to detect security vulnerabilities and malicious patterns in AI agent skills (e.g., Claude Code, Codex CLI).
Key features
Multiple input formats: Supports scanning Git repositories, URLs, ZIP files, directories, and single files
64 vulnerability patterns: 16 categories including prompt injection, data leakage, privilege escalation, supply chain attacks, excessive agency, output handling, system prompt leakage, memory poisoning, tool misuse, log agent, trigger abuse, risky code (AST), taint tracking, YARA signatures, MCP least privilege, MCP tool poisoning
Two-stage analysis: Fast static analysis + optional LLM semantic evaluation
Real-time vulnerability lookup: Live CVE data via OSV.dev with automatic offline fallback
Multiple output formats: Terminal, JSON, Markdown, SARIF reports
Risk scoring: 0-100 score with severity labels and recommendations
When to use it
Use to assess security risks before installing AI agent skills (e.g., for Claude Code, Codex CLI, Gemini CLI). Particularly useful for verifying skills shared by the community or from third-party repositories. Can also be integrated into CI/CD pipelines for continuous security checks.