# How NVIDIA SkillSpector Detects Prompt Injection Vulnerabilities in AI Agent Skills

> Discover how NVIDIA SkillSpector uses static code analysis and regex pattern matching to detect prompt injection vulnerabilities in AI agent skills before execution.

- Repository: [NVIDIA Corporation/SkillSpector](https://github.com/NVIDIA/SkillSpector)
- Tags: how-to-guide
- Published: 2026-06-22

---

**NVIDIA SkillSpector treats prompt injection as a static code analysis problem, using regex-based pattern matching across four vulnerability families to flag dangerous instructions before execution.**

The NVIDIA/SkillSpector repository provides a static analysis engine specifically designed to scan AI agent skills—the markdown files and code snippets that define LLM behavior—for prompt injection attacks. Unlike dynamic testing that requires running the model, SkillSpector analyzes skill files offline using targeted regular expressions that identify instruction overrides, hidden payloads, data exfiltration commands, and behavior manipulation attempts.

## The Four Pattern Families for Prompt Injection Detection

SkillSpector’s **Prompt-Injection analyzer** ([`static_patterns_prompt_injection.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_prompt_injection.py)) organizes detection into four severity-ranked pattern families labeled P1 through P4. Each family targets a specific attack vector with dedicated regex patterns and confidence scores.

### P1 – Instruction Override

This family catches text that explicitly tells the model to ignore safety guidelines or previous instructions. The analyzer searches for patterns like `ignore\s+(?:all\s+)?previous\s+instructions?`, flagging attempts to "jailbreak" the agent with approximately 0.8 confidence. These matches indicate direct attempts to override system prompts or safety guardrails.

### P2 – Hidden Instructions

Hidden instruction detection focuses on obfuscation techniques including HTML comments, markdown tricks, zero-width Unicode characters, and large base-64 blobs that conceal malicious directives. The regex `<!--.*?(?:system|instructions?|ignore|POST|GET|send|transmit).*?-->` specifically targets HTML comments containing system-level commands. Notably, `static_runner._infer_file_type` restricts P2 scanning to markdown and "other" file types, as these formats commonly support comment syntax that could hide payloads.

### P3 – Exfiltration Commands

This pattern family identifies attempts to steal conversation context or user data by matching phrases requesting external transmission. The regex `(send|transmit|upload|post|forward)\s+(?:the\s+)?(?:conversation|context|chat|history)\s+to` detects instructions asking the model to POST chat history to remote endpoints. These findings carry high severity due to their direct privacy implications.

### P4 – Behavior Manipulation

Subtle steering language that nudges models toward specific biases or recommendations falls under P4. Patterns like `always\s+(?:recommend|suggest|prefer|choose|use)\s+(?:\w+\s+){0,3}(?:over|instead\s+of|rather\s+than)` catch attempts to manipulate the agent's decision-making without explicitly overriding instructions.

## The Static Analysis Pipeline

The detection flow follows a six-stage pipeline implemented across [`static_runner.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_runner.py) and the pattern-specific analyzer modules.

### 1. File Type Inference

The process begins in `static_runner._infer_file_type`, which maps file extensions to logical types such as "markdown" or "python." This classification determines which pattern families apply—a critical filtering step since hidden instruction detection (P2) only runs on markdown and plain text files.

### 2. Pattern Execution

The generic runner calls each analyzer's `analyze` function, passing the file content, path, and inferred type as parameters. This abstraction allows the prompt-injection analyzer to operate independently while maintaining consistent interfaces with other static analysis modules.

### 3. Regex Matching and Finding Generation

Within `static_patterns_prompt_injection.analyze`, the engine iterates over the four pattern lists (P1-P4). For each regex match, it:

- Calculates the line number using `get_line_number`
- Constructs a `Location` object (`loc`) specifying file path and position
- Captures surrounding context (`ctx`) for the snippet
- Emits an `AnalyzerFinding` containing the rule ID, severity label, confidence score, and `PatternCategory.PROMPT_INJECTION` tag

### 4. Graph Integration

`static_runner.analyzer_finding_to_finding` converts each `AnalyzerFinding` into a graph-wide `Finding` object stored in the `SkillspectorState`. During this conversion, the system fetches default explanations and remediation steps from [`pattern_defaults.py`](https://github.com/NVIDIA/SkillSpector/blob/main/pattern_defaults.py), mapping rule IDs like "P1" to human-readable descriptions such as "Instruction Override" along with specific fix recommendations.

### 5. Optional LLM Enrichment

When `use_llm` is enabled, the **Meta-Analyzer** (`LLMMetaAnalyzer` in [`meta_analyzer.py`](https://github.com/NVIDIA/SkillSpector/blob/main/meta_analyzer.py)) performs secondary validation. This step re-queries an LLM to confirm static findings and can append additional explanations or remediation suggestions. However, this enrichment is strictly optional—it does not affect the core detection logic or initial flagging of vulnerabilities.

### 6. Report Generation

All confirmed findings render in SARIF or HTML reports, grouped under the "Prompt Injection" category as defined in `PatternCategory.PROMPT_INJECTION`. The reports include file paths, line numbers, confidence scores, and remediation guidance drawn from the pattern defaults configuration.

## Implementation Details and Code Examples

### Running the CLI Scanner

Execute the full analysis pipeline from the command line:

```bash
$ skill-spector scan ./my-skill

```

The CLI entry point ([`src/skillspector/cli.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/cli.py)) loads skill files into a `SkillspectorState` and invokes `static_runner.run_static_patterns`, which triggers the prompt-injection node's analysis routine.

### Direct API Usage

Integrate the analyzer programmatically using the internal API:

```python
from skillspector.graph import build_graph
from skillspector.nodes.analyzers.static_patterns_prompt_injection import node
from skillspector.state import SkillspectorState

# Initialize state with skill files

state = SkillspectorState(
    components=["skill.md", "helper.py"],
    file_cache={
        "skill.md": open("skill.md").read(),
        "helper.py": open("helper.py").read()
    },
)

# Execute prompt-injection analysis

prompt_findings = node(state)["findings"]

for finding in prompt_findings:
    print(f"Rule {finding.rule_id} at {finding.location.file}:{finding.location.start_line}")
    print(f"  Message: {finding.message}")
    print(f"  Confidence: {finding.confidence}")

```

The `node` wrapper function delegates to `static_runner.run_static_patterns` and returns a list of `Finding` objects containing location data, severity ratings, and remediation metadata.

### Inspecting Detection Patterns

Examine the specific regex patterns used for exfiltration detection:

```python
from skillspector.nodes.analyzers.static_patterns_prompt_injection import P3_PATTERNS

for regex, confidence in P3_PATTERNS:
    print(f"Pattern: {regex.pattern if hasattr(regex, 'pattern') else regex}")
    print(f"Confidence threshold: {confidence}")

```

This outputs the compiled regular expressions and their associated confidence scores defined in the P3 pattern list, allowing security researchers to audit detection logic or extend coverage with custom patterns.

## Summary

- **Static analysis approach**: SkillSpector detects prompt injection without executing the LLM, using regex patterns to scan skill files before deployment.
- **Four detection families**: P1 (Instruction Override), P2 (Hidden Instructions), P3 (Exfiltration Commands), and P4 (Behavior Manipulation) provide comprehensive coverage of injection vectors.
- **Language-agnostic pipeline**: The [`static_runner.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_runner.py) framework supports multiple file types while applying context-aware filtering (e.g., P2 patterns only for markdown).
- **Structured findings**: Each match generates an `AnalyzerFinding` with precise location data, confidence scores, and remediation guidance from [`pattern_defaults.py`](https://github.com/NVIDIA/SkillSpector/blob/main/pattern_defaults.py).
- **Optional LLM validation**: The `LLMMetaAnalyzer` provides secondary confirmation but does not gate the initial detection, ensuring fast, deterministic static analysis.

## Frequently Asked Questions

### How accurate is SkillSpector's prompt injection detection?

SkillSpector employs deterministic regex matching with confidence scores ranging from 0.5 to 0.8 depending on the pattern family. While P1 patterns for explicit instruction overrides achieve approximately 0.8 confidence, the optional `LLMMetaAnalyzer` can reduce false positives by validating static findings against an LLM. However, the core detection remains purely pattern-based, ensuring consistent results across scans without requiring model inference.

### Can SkillSpector detect zero-day prompt injection techniques?

The analyzer relies on curated regex patterns in [`static_patterns_prompt_injection.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_prompt_injection.py), meaning it detects known attack vectors rather than novel techniques. Security teams can extend coverage by adding custom patterns to the P1-P4 lists or modifying [`pattern_defaults.py`](https://github.com/NVIDIA/SkillSpector/blob/main/pattern_defaults.py) to include new remediation strategies for emerging threats.

### What file formats does the prompt injection scanner support?

The `static_runner._infer_file_type` method maps file extensions to logical types, with full support for markdown, Python, and plain text files. Hidden instruction detection (P2) specifically targets markdown and "other" categorized files, as these formats commonly support HTML comments and encoding tricks used to obfuscate malicious instructions.

### Does SkillSpector require an LLM to detect prompt injection?

No. The core detection engine operates entirely through static regex analysis in `static_patterns_prompt_injection.analyze`. The LLM integration via [`meta_analyzer.py`](https://github.com/NVIDIA/SkillSpector/blob/main/meta_analyzer.py) serves only as an optional enrichment layer that adds explanations or validates findings—it does not control whether vulnerabilities are initially flagged or reported.