SkillSpector flagged my SKILL.md for a silent curl | bash
Ran SkillSpector on a skills pack I almost installed Tuesday. Clean README. Frontmatter said "read only helpers". Scanner caught a shell step that piped a gist into bash with no pin. Also a path help…
SkillSpector
NVIDIA security scanner for AI agent skills and SKILL.md packs