SkillSpector is an open-source security scanner from NVIDIA that vets AI agent skills before they are installed, answering the question of whether a given skill is safe to use. Agent skills can look harmless while hiding risky instructions, overbroad permissions, or executable code that does more than the description claims - research cited by the project found 26.1% of skills contain vulnerabilities and 5.2% show likely malicious intent. SkillSpector accepts Git repositories, URLs, zip files, directories, and single files, running fast static checks by default with optional LLM semantic analysis for issues that require intent comparison. It covers 64 vulnerability patterns across 16 categories, including prompt injection, data exfiltration, privilege escalation, supply-chain attacks, memory poisoning, tool misuse, trigger abuse, and MCP-specific risks. It fits into skill publishing and catalog pipelines as an automated risk-scanning step.