Made for Swiss self-employed & SMEs
Your AI assistant learns new tricks through add-ons: ready-made instruction packages that teach it to draft offers, read files or answer in your tone. Handy — and a bit like installing software from a stranger. A free scanner from NVIDIA now looks inside such add-ons before you install them.
What a “skill” actually is
Tools like Claude Code, Codex or Gemini CLI load small packages called skills. A skill is usually a text file with instructions, sometimes with small scripts attached. It shows your AI how to handle a task — and it typically runs with access to whatever the assistant can see: files, text you paste, sometimes the network.
Most skills come from public marketplaces and repositories. Many are genuinely useful and harmless. But an add-on that can read what your AI reads is an add-on worth a second look.
The uncomfortable numbers
SkillSpector was built on a research study that examined 42,447 skills from major marketplaces. The result: 26.1 percent contained at least one security flaw, and 5.2 percent showed signs of likely malicious intent. Skills that include executable scripts were more than twice as likely to be problematic.
Two dangers matter most for an office:
- Hidden instructions: a skill can contain orders your AI follows without showing you — for example “ignore the previous rules”, or directions tucked away in comments.
- Quiet data leaks: a skill can send content outward — text from your files, saved passwords, file paths — to an address you never chose.
If your assistant can open client documents, a badly behaved add-on can too.
What the scanner does
SkillSpector, released as open source (Apache 2.0) by NVIDIA, examines a skill before installation. You point it at a link, a folder or a zip file, and it works in two passes:
- First pass: fast static checks against 64 known vulnerability patterns in 16 categories — hidden instructions, data leaks, supply-chain tricks, excessive permissions — plus a live check of the skill’s building blocks against a public database of known weak spots.
- Second pass (optional): an AI model reads the flagged passages in context and sorts out false alarms. This pass can even run against a local model such as Ollama, so the scan itself sends nothing to a cloud.
The result is a risk score from 0 to 100, a severity label and a report that points to the exact line behind every finding — so whoever looks after your IT can judge, not just trust a number.
What this means for a Swiss small business
You don’t have to run the scanner yourself to take the lesson seriously. Under the revised Swiss data protection law, you remain responsible for client data that your tools touch — a leak through a “helpful” add-on is still your leak. A few habits cover most of the risk:
- Install AI add-ons only from sources you can name.
- Ask what an add-on is allowed to read before it comes near client files.
- Have new add-ons checked first — with SkillSpector, or by whoever looks after your IT.
- Keep client data away from tools nobody has checked.
Honest limits: a scan is a snapshot, not a guarantee — it analyses code, not behaviour at runtime, and it cannot read text hidden in images. And the tool is built for agent skills specifically; if you never install such add-ons, the habit matters more than the tool. The convenience of one-click AI extensions is real. So is the responsibility that comes with it.
