--- title: "Securing AI skill repositories with Nvidia SkillSpector and GitHub Actions" url: https://daily.dev/posts/securing-ai-skill-repositories-with-nvidia-skillspector-and-github-actions-klcvhyqqz source_url: https://thomasthornton.cloud/securing-ai-skill-repositories-with-nvidia-skillspector-and-github-actions type: article source: "Thomas Thornton" published: 2026-07-01T10:51:53.418Z updated: 2026-07-01T10:52:33.193Z tags: ["security", "mcp", "github-actions", "prompt-injection"] reading_time: 12 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Securing AI skill repositories with Nvidia SkillSpector and GitHub Actions **[Thomas Thornton](https://daily.dev/sources/thomasthornton)** · 12 min read · 1 upvotes · 0 comments ## Summary AI agent skill files (SKILL.md, AGENTS.md, MCP configs, custom instructions) sit inside the engineering trust boundary and introduce supply-chain risk. NVIDIA SkillSpector can scan these files for prompt-injection patterns, exfiltration behavior, unsafe tool-usage chains, and policy-bypass tactics. Two GitHub Actions workflows are provided: a baseline repository scan that produces SARIF output uploaded to GitHub Code Scanning, and a focused PR scan that identifies changed skill directories, scans only those, and posts results as a PR comment. The post covers exit code handling, LLM-backed semantic analysis via Azure AI Foundry, artifact retention, and practical guidance on when to use targeted vs. full-repo scanning. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Detecting Vulnerabilities in Agent Skills with SkillSpector: From Green Checkmark to Real Security Judgment](https://daily.dev/posts/detecting-vulnerabilities-in-agent-skills-with-skillspector-from-green-checkmark-to-real-security-j-u6pwwx1n8) · Towards Data Science · 1 upvotes · 0 comments - [Auditing Agent Skills: A Threat Model for the Next Generation of AI Package Managers](https://daily.dev/posts/auditing-agent-skills-a-threat-model-for-the-next-generation-of-ai-package-managers-vxdluywso) · DEV · 8 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#mcp](https://daily.dev/tags/mcp), [#github-actions](https://daily.dev/tags/github-actions), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/securing-ai-skill-repositories-with-nvidia-skillspector-and-github-actions-klcvhyqqz)