SkillSpector

No entries match these filters. Clear filters

1. v2.13.3 Nov 2, 2026 · issue 128

   SkillSpector adds configurable batch and workflow-deadline limits and now detects writes to agent-memory files and inspects npx commands in JSON MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. configurations⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.13.3 https://github.com/NVIDIA/SkillSpector.git
   # already have the repo? check out this version:
   $ git checkout v2.13.3

   └──▷ TRY IT
   Run a large skill collection scan without hitting the default 256-batch or 18-minute limits by raising both caps for a provider with high throughput.
   copy

   $ SKILLSPECTOR_TP4_MAX_BATCHES=512 SKILLSPECTOR_MAX_WORKFLOW_SECONDS=3600 SKILLSPECTOR_MAX_LLM_CONCURRENCY=8 skillspector scan ./my-large-skill/

   • Control the tool-description comparison batch limit with SKILLSPECTOR_TP4_MAX_BATCHES (default 256) and the workflow deadline with SKILLSPECTOR_MAX_WORKFLOW_SECONDS (default 1,080 seconds), and honor LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. concurrency via SKILLSPECTOR_MAX_LLM_CONCURRENCY.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • SkillSpector now inspects npx commands in JSON MCP configurations and recognizes additional Claude, Cline, and Roo Code credential and configuration filenames.
   • SkillSpector now detects writes to known agent-memory files and directories from automatically run test carriers, including raw Windows paths.
   • SkillSpector adds a bounded YARA signal for nearby directory walking, encryption, and binary writes across lines to surface potential ransomware-like behavior alongside existing stronger rules.
   • SkillSpector now extracts Pipenv dependencies and checks locked versions, preserving incomplete coverage for malformed or unsupported dependency declarations.

   +4 more show less

   • SkillSpector now follows credential reads nested in urllib request headers into network sinks.
   • SkillSpector now rejects baseline and recursive report destinations that would overwrite the primary input or a discovered child skill's input, including file aliases.
   • SkillSpector now reports incomplete inspection when a requested custom YARA rule directory is unavailable.
   • Non-English gap-fill findings are now included in contributed batch-scan scores, recommendations, and exit status instead of retaining a stale SAFE verdict.
   • Control the tool-description comparison batch limit with SKILLSPECTOR_TP4_MAX_BATCHES (default 256) and the workflow deadline with SKILLSPECTOR_MAX_WORKFLOW_SECONDS (default 1,080 seconds), and honor LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. concurrency via SKILLSPECTOR_MAX_LLM_CONCURRENCY.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • SkillSpector now detects writes to known agent-memory files and directories from automatically run test carriers, including raw Windows paths.
   • SkillSpector adds a bounded YARA signal for nearby directory walking, encryption, and binary writes across lines to surface potential ransomware-like behavior alongside existing stronger rules.
   • SkillSpector now extracts Pipenv dependencies and checks locked versions, preserving incomplete coverage for malformed or unsupported dependency declarations.

   5 more in Everything

2. v2.13.1 Oct 23, 2026 · issue 118

   v2.13.1 enforces atomic, no-follow report and baseline writes; rejects invalid flag combinations for --recursive and --mcp-registry with exit code 2; and surfaces batch gap-fill failures via gap_fill_status: "incomplete".

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.13.1 https://github.com/NVIDIA/SkillSpector.git
   # already have the repo? check out this version:
   $ git checkout v2.13.1

   • Writes report files (scan, scan --recursive, scan --mcp-registry, and --output) and baselines atomically through an already-opened, no-follow parent directory; skillspector baseline <path> -o - writes the baseline as JSON to stdout.
   • Rejects --use-shipped-baseline with exit code 2 when scan --recursive detects one or more child skills, before any report is written.
   • Rejects scan --mcp-registry combined with --use-shipped-baseline, --transitive, --transitive-depth, --transitive-allow-prefix, or --transitive-deny-prefix with exit code 2 before the registry is read or a report is written.
   • Reports failed batch gap-fill passes as incomplete with gap_fill_status: "incomplete", failure reasons, and at least a CAUTION recommendation; the batch run exits with code 2.
   • Reports a complete recursive scan whose highest score is MEDIUM (21-50) as CAUTION instead of SAFE, matching child reports.

   5 details in Everything

   • Updated detection P2 hidden-instruction detection scope correction
   • New detection HIGH MP3 finding for state/memory adoption instructions
   • Updated detection TM1 repeated Python assignment handling
   └──▷ BREAKING ON UPGRADE

   • !scan --recursive now rejects --use-shipped-baseline with exit code 2 when child skills are detected; previously the option was silently ignored.
   • !scan --mcp-registry now rejects --use-shipped-baseline, --transitive, --transitive-depth, --transitive-allow-prefix, and --transitive-deny-prefix with exit code 2; previously these options were silently ignored.
   • !A complete recursive scan with a highest score of MEDIUM (21-50) now exits with CAUTION instead of SAFE.
3. v2.13.0 Oct 16, 2026 · issue 111

   SkillSpector v2.13.0 hardens MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. access, expands Python/TypeScript/binary detection, and fixes baseline and batch-scan integrity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.13.0 https://github.com/NVIDIA/SkillSpector.git
   # already have the repo? check out this version:
   $ git checkout v2.13.0

   • Restricts MCP HTTP listeners to loopback; remote deployments require an authenticating proxy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds detection for bundled settings that use the short -r flag to load and run extra code, and flags bundled settings that run commands, redirect AI traffic, or automatically approve connected tool servers.
   • Detects encoded shell payloads that are decoded and executed.
   • Adds lower-confidence warnings for multiline scripts that appear to open a remote shell, while preserving existing one-line detections.
   • Detects sensitive data passed to urllib opener requests, including inline opener calls.

   +5 more show less

   • Finds Python flows from secret reads to risky uses even when assignments and uses appear at different nesting depths.
   • Inspects readable instructions hidden behind binary file prefixes while keeping ordinary PDF/GIF assets and XMP metadata from producing false alarms.
   • Treats OMS signing bundles as untrusted input, inspecting decoded metadata and preserving raw evidence and incomplete coverage when parsing fails.
   • Improves executable-file detection by checking complete TypeScript declaration files before treating them as non-executable, so partial or disguised runtime code is not skipped, and by recognizing more executable Python files, including .pyw files and extensionless launchers.
   • Inspects hooks declared in Claude plugin manifests and reports incomplete coverage when those declarations cannot be fully checked.
   • Restricts MCP HTTP listeners to loopback; remote deployments require an authenticating proxy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds detection for bundled settings that use the short -r flag to load and run extra code, and flags bundled settings that run commands, redirect AI traffic, or automatically approve connected tool servers.
   • Detects encoded shell payloads that are decoded and executed.
   • Detects sensitive data passed to urllib opener requests, including inline opener calls.
   • Inspects readable instructions hidden behind binary file prefixes while keeping ordinary PDF/GIF assets and XMP metadata from producing false alarms.

   +2 more show less

   • Treats OMS signing bundles as untrusted input, inspecting decoded metadata and preserving raw evidence and incomplete coverage when parsing fails.
   • Inspects hooks declared in Claude plugin manifests and reports incomplete coverage when those declarations cannot be fully checked.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The Codex CLI analysis provider is disabled; any workflow relying on it must switch to another supported provider.
   • !MCP HTTP listeners are restricted to loopback; remote MCP deployments that previously accepted direct connections now require an authenticating proxy.
   • !Exact-fingerprint baselines are version-bound and must be regenerated after upgrading to v2.13.0.
   • !NVIDIA Build defaults to GLM-5.3 after retirement of the previous default (GLM-5.2); explicit model overrides remain supported.
   • !Baseline generation uses atomic replacement; updates that cannot preserve ownership or group safely are refused — write a new baseline file instead.
   • !If a real directory ending in ! collides with an archive-member path, that directory must be renamed to allow both files to be fully inspected.
4. v2.12.0 Sep 23, 2026 · issue 084

   SkillSpector v2.12.0 adds --fail-on-findings, SC10 supply-chain detection, opencode_cli provider, TP4 Markdown fences, and GitHub tree scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.12.0 https://github.com/NVIDIA/SkillSpector.git
   # already have the repo? check out this version:
   $ git checkout v2.12.0

   └──▷ TRY IT
   Fail CI immediately when a skill scan surfaces any active finding, useful as a hard gate in a pull-request pipeline.
   copy

   $ skillspector scan ./my-skill/ --fail-on-findings

   Scan only a specific subdirectory of a GitHub repository, such as a single skill inside a monorepo.
   copy

   $ skillspector scan https://github.com/org/skills-monorepo/tree/main/skills/my-skill

   • Adds skillspector scan --fail-on-findings flag that exits with code 1 when any active finding is present, including findings below the default risk-score threshold, across single-skill, recursive, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. registry scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds SKILLSPECTOR_MAX_STATIC_ANALYSIS_SECONDS_PER_ARTIFACT environment variable to configure static-pattern and YARA time allowance per artifact; default raised from 30 to 300 seconds.
   • Adds SKILLSPECTOR_COMPACT_PROMPTS=1 (also true / yes) to enable shorter unpadded LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. prompt line labels such as L1: instead of L01:.
   • Adds SKILLSPECTOR_PROVIDER=opencode_cli to run semantic analysis through a local OpenCode login, requiring exactly OpenCode 1.18.31 and failing closed on auth, version, policy, or empty-output failures.
   • Adds a native /skillspector command and skillspector_scan tool to OpenCode via the repository-provided .opencode/ extension; installed by copying .opencode/ from a checkout, resolved via SKILLSPECTOR_BIN, a worktree .venv, or PATH.

   +11 more show less

   • Adds SC10 detection of noncanonical or unresolved dependency sources across npm, Yarn, pip, Poetry, Maven, and Cargo configuration, shell scripts, generated heredocs, and actionable shell fences in SKILL.md/README.md.
   • Supports HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. GitHub /tree/ URLs to select a repository subdirectory as scan input, resolving the longest advertised branch/tag name including refs containing slashes.
   • Registers gemini-3.5-flash model budgets for the root and OpenAI-compatible registries, enabling use through the existing openai provider.
   • Extends TP4 semantic analysis to non-empty, closed Markdown/text fences with recognized executable-language labels.
   • Adds metadata.llm_provenance (schema version 1) to JSON reports, recording sanitized model/package/source identity, configured vs. effective providers, and sampling/reasoning controls; SKILLSPECTOR_BUILD_REVISION can supply source revision metadata.
   • Detects reflective Python module lookups and shipped bytecode inside Python environments.
   • Non-verbose interactive terminal scans now stream graph execution progress, completed analyzer rules, and a discovered-file tree to standard error without affecting machine-readable standard output.
   • Distinguishes reference_missing from reference_unresolved in MCP installation decisions, allowing scans whose only caveats are missing references to proceed when all discovered files were inspected.
   • JSON findings retain each occurrence's own zero-based columns; SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. emits one-based Unicode-codepoint columns for active and suppressed findings.
   • CLI-backed providers now honor SKILLSPECTOR_MODEL_REGISTRY for per-model context and output-token limits.
   • GHSA/OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. MODERATE severity now maps to MEDIUM instead of the previous LOW, potentially increasing affected supply-chain risk scores.
   • Adds skillspector scan --fail-on-findings flag that exits with code 1 when any active finding is present, including findings below the default risk-score threshold, across single-skill, recursive, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. registry scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds SKILLSPECTOR_MAX_STATIC_ANALYSIS_SECONDS_PER_ARTIFACT environment variable to configure static-pattern and YARA time allowance per artifact; default raised from 30 to 300 seconds.
   • Adds SKILLSPECTOR_COMPACT_PROMPTS=1 (also true / yes) to enable shorter unpadded LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. prompt line labels such as L1: instead of L01:.
   • Adds SKILLSPECTOR_PROVIDER=opencode_cli to run semantic analysis through a local OpenCode login, requiring exactly OpenCode 1.18.31 and failing closed on auth, version, policy, or empty-output failures.
   • Adds a native /skillspector command and skillspector_scan tool to OpenCode via the repository-provided .opencode/ extension; installed by copying .opencode/ from a checkout, resolved via SKILLSPECTOR_BIN, a worktree .venv, or PATH.

   +5 more show less

   • Adds SC10 detection of noncanonical or unresolved dependency sources across npm, Yarn, pip, Poetry, Maven, and Cargo configuration, shell scripts, generated heredocs, and actionable shell fences in SKILL.md/README.md.
   • Registers gemini-3.5-flash model budgets for the root and OpenAI-compatible registries, enabling use through the existing openai provider.
   • Adds metadata.llm_provenance (schema version 1) to JSON reports, recording sanitized model/package/source identity, configured vs. effective providers, and sampling/reasoning controls; SKILLSPECTOR_BUILD_REVISION can supply source revision metadata.
   • Detects reflective Python module lookups and shipped bytecode inside Python environments.
   • Non-verbose interactive terminal scans now stream graph execution progress, completed analyzer rules, and a discovered-file tree to standard error without affecting machine-readable standard output.

   6 more in Everything

5. v2.11.1 Sep 7, 2026 · issue 067

   SkillSpector v2.11.1 raises the default workflow deadline to 600s and adds SKILLSPECTOR_MAX_WORKFLOW_SECONDS to make it configurable.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.11.1 https://github.com/NVIDIA/SkillSpector.git
   # already have the repo? check out this version:
   $ git checkout v2.11.1

   └──▷ TRY IT
   Override the default 600-second deadline when scanning a large recursive skill tree that needs more time.
   copy

   $ SKILLSPECTOR_MAX_WORKFLOW_SECONDS=1800 skillspector scan ./my-large-skill/

   Set a persistent custom deadline in a Docker env-file so all container-based scans share the same budget.
   .env copy

   SKILLSPECTOR_PROVIDER=anthropic
   ANTHROPIC_API_KEY=sk-ant-...
   SKILLSPECTOR_MAX_WORKFLOW_SECONDS=1200

   • Adds SKILLSPECTOR_MAX_WORKFLOW_SECONDS environment variable to set a custom positive finite aggregate workflow deadline; invalid, zero, negative, infinite, and NaN values fall back to the 600-second default.
   • Raises the default aggregate end-to-end workflow and transitive traversal deadline from 60 seconds to 600 seconds, preventing larger valid scans from timing out.
   • Applies the configured deadline consistently across direct CLI, recursive, transitive, and multi-skill analysis paths.
   • Adds SKILLSPECTOR_MAX_WORKFLOW_SECONDS environment variable to set a custom positive finite aggregate workflow deadline; invalid, zero, negative, infinite, and NaN values fall back to the 600-second default.

   2 more in Everything

6. v2.11.0 Aug 28, 2026 · issue 058

   SkillSpector v2.11.0 adds npm lockfile scanning, BH1–BH3 hook/permission findings, and LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. sampling controls via new env vars.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.11.0 https://github.com/NVIDIA/SkillSpector.git
   # already have the repo? check out this version:
   $ git checkout v2.11.0

   └──▷ TRY IT
   Pin LLM output for reproducible scans when using an OpenAI-compatible endpoint — useful for CI pipelines where you want consistent results across runs.
   copy

   $ SKILLSPECTOR_TEMPERATURE=0 SKILLSPECTOR_SEED=42 skillspector scan ./my-skill/

   Pass LLM sampling controls via a .env file for Docker-based scans to keep credentials and tuning out of shell history.
   .env copy

   SKILLSPECTOR_PROVIDER=openai
   OPENAI_API_KEY=sk-...
   SKILLSPECTOR_TEMPERATURE=0
   SKILLSPECTOR_SEED=42

   • Adds SKILLSPECTOR_TEMPERATURE (values 0–1) and SKILLSPECTOR_SEED (integers) environment variables for optional LLM sampling control; forwarded to OpenAI-compatible and Azure OpenAI endpoints; leaving either unset preserves provider defaults.
   • Expands skillspector scan --help to list all supported hosted, local, compatible, and CLI-backed LLM providers with their authentication paths.
   • Introduces BH1–BH3 findings by analyzing hooks/hooks.json, .claude/settings.json, and .claude/settings.local.json for bundled lifecycle hook execution (BH1), directly proven remote transfer of sensitive event or file content (BH2), and broad or ignored project permission surfaces (BH3).
   • Supports safe file traversal in restricted Linux sandboxes by opening intermediate path components with O_PATH where available, without requiring read access to every ancestor directory.

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Existing scans may now report new BH1–BH3 findings for supported bundled hook and settings files (hooks/hooks.json, .claude/settings.json, .claude/settings.local.json); review those findings and use the existing baseline mechanism only after validating the declared execution or permission surface.
7. v2.10.0 Aug 26, 2026 · issue 058

   SkillSpector v2.10.0 adds transitive scanning, hidden/nested artifact inspection, EA5 detection, and new env var + report field for policy gates.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.10.0 https://github.com/NVIDIA/SkillSpector.git
   # already have the repo? check out this version:
   $ git checkout v2.10.0

   └──▷ TRY IT
   Scan a skill and all skills it references transitively, limiting traversal depth and restricting allowed prefixes, to catch supply-chain risks in the full dependency graph.
   copy

   $ skillspector scan ./my-skill/ --transitive --transitive-depth 2 --transitive-allow-prefix https://github.com/trusted-org/ --transitive-deny-prefix https://github.com/untrusted-org/

   Gate a CI pipeline on the highest severity found — fail the build if any HIGH or CRITICAL issue is present — by reading risk_assessment.max_issue_severity from the JSON report.
   copy

   $ skillspector scan ./my-skill/ --format json --output report.json && python -c "import json,sys; r=json.load(open('report.json')); sys.exit(0 if r['risk_assessment']['max_issue_severity'] in ('NONE','LOW') else 1)"

   Produce LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. finding text in French for a report shared with a francophone security team.
   copy

   $ SKILLSPECTOR_OUTPUT_LANGUAGE=French skillspector scan ./my-skill/ --format markdown --output report.md

   • Adds --transitive flag to opt into transitive scanning of referenced skills, with --transitive-depth, --transitive-allow-prefix, and --transitive-deny-prefix controls for bounded traversal.
   • Adds SKILLSPECTOR_OUTPUT_LANGUAGE environment variable to set the language of human-readable LLM-generated finding text.
   • Adds risk_assessment.max_issue_severity field to JSON output (value NONE when no active issue is reported) for machine-readable downstream policy gates.
   • Adds bounded local inspection of hidden files and ZIP-compatible nested artifacts (DOCX, XLSX, PPTX) without extracting or executing members, raising HIGH SC9 findings for concealed executables.
   • Adds EA5 static findings for external model or provider selection, including silent coding-CLI account switches and top-level model pins.

   +3 more show less

   • Adds structured skill summaries for valid AISOP/AISP bundles across terminal, Markdown, JSON, and SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output formats.
   • Adds dynamic analyzer discovery and validates risk-score inputs against the registered analyzer set.
   • Surfaces partial provider execution and traversal truncation so incomplete deep scans cannot silently appear clean.

   8 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !langgraph-cli[inmem] is moved from the base installation to the langgraph-dev optional extra; LangGraph Studio users who install only the base package must now install skillspector[langgraph-dev] explicitly.
8. v2.9.5 Aug 15, 2026 · issue 047

   SkillSpector v2.9.5 adds Ollama, Azure OpenAI, and generic OpenAI-compatible providers, opt-in .skillspector-baseline.yaml auto-discovery, and static detection for insecure deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution. (AST10, TT6, DS1–DS4).

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.9.5 https://github.com/NVIDIA/SkillSpector.git
   # already have the repo? check out this version:
   $ git checkout v2.9.5

   • Adds opt-in auto-discovery of a top-level .skillspector-baseline.yaml file, keeping explicitly supplied baselines authoritative when both are present.
   • Adds Ollama support for local OpenAI-compatible inference, Azure OpenAI deployment routing, and a configurable provider for generic OpenAI-compatible endpoints.
   • Adds static analyzer coverage for insecure deserialization patterns represented by findings AST10, TT6, DS1, DS2, DS3, and DS4.
   • Switches YARA match-to-source-line mapping to byte offsets so non-ASCII content is reported at accurate locations.
   • Scopes the destructive-autonomy YARA post-filter to SkillSpector's built-in rule namespace and preserves deterministic built-in rule precedence, preventing custom YARA rules that reuse a built-in rule name from being incorrectly post-filtered.

   5 details in Everything

9. v2.9.4 Aug 13, 2026 · issue 044

   SkillSpector v2.9.4 adds whitespace-padding prompt-injectionprompt-injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. detection, Python bytecode supply-chain finding (SC8), and hardens HTTP MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. transport against local-path abuse.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.9.4 https://github.com/NVIDIA/SkillSpector.git
   # already have the repo? check out this version:
   $ git checkout v2.9.4

   └──▷ TRY IT
   Run SkillSpector's MCP server over stdio (trusted local transport) to retain the ability to scan local filesystem paths after the HTTP restriction.
   copy

   $ skillspector mcp --transport stdio

   • Adds detection for whitespace-padding techniques used to hide prompt-injection instructions in skill content.
   • Adds a HIGH-severity SC8 finding when a skill ships Python bytecode or __pycache__ content, expanding supply-chain coverage.
   • HTTP MCP transport (skillspector mcp with http transport) now rejects local filesystem scan targets and local YARA-rule directories, enforcing a security boundary between remote callers and scanner-host paths; stdio transport retains full local-scan capability.
   • Recognises allowed-tools as valid least-privilege permission guidance in remediations and documentation.
   • Ships a new Skill Inspector companion skill guide.

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !HTTP MCP clients can no longer scan local filesystem paths or provide local YARA-rule directories; switch to a remote repository or URL for HTTP requests, or use stdio transport for local scans.
10. v2.5.2 Aug 4, 2026 · issue 036

    SkillSpector v2.5.2 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. registry posture scanning and enforces ingest size caps via INGEST_MAX_BYTES and INGEST_MAX_ZIP_MEMBERS.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.2 https://github.com/NVIDIA/SkillSpector.git
    # already have the repo? check out this version:
    $ git checkout v2.5.2

    • Enforces INGEST_MAX_BYTES (100 MiB) cap on streamed URL downloads, total uncompressed zip size, and post-clone Git repo disk usage, and INGEST_MAX_ZIP_MEMBERS (10,000) cap on zip entries — failing closed with IngestLimitExceededError on breach.

    1 detail in Everything

11. v2.5.1 Jul 31, 2026 · issue 031

    SkillSpector v2.5.1 adds SKILLSPECTOR_MAX_LLM_CONCURRENCY to throttle async LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. batch requests for rate-limited providers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.1 https://github.com/NVIDIA/SkillSpector.git
    # already have the repo? check out this version:
    $ git checkout v2.5.1

    └──▷ TRY IT
    Serialize LLM analyzer requests to avoid bursting a rate-limited provider such as Anthropic.
    copy

    $ export SKILLSPECTOR_MAX_LLM_CONCURRENCY=1
    export SKILLSPECTOR_PROVIDER=anthropic
    export ANTHROPIC_API_KEY=sk-ant-...
    skillspector scan ./my-skill/

    • Adds SKILLSPECTOR_MAX_LLM_CONCURRENCY environment variable to control the default concurrency of asynchronous LLM analyzer batches (default 10; values below 1 clamp to 1; blank or invalid values retain the default).

    1 detail in Everything

12. v2.5.0 Jul 27, 2026 · issue 028

    SkillSpector v2.5.0 adds inspection-ledger reporting with execution-completeness fields in JSON/SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. and v2 baseline fingerprints.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.0 https://github.com/NVIDIA/SkillSpector.git
    # already have the repo? check out this version:
    $ git checkout v2.5.0

    └──▷ TRY IT
    Check whether a scan completed reliably in CI — block the pipeline if execution_successful is false rather than silently accepting a zero-finding report.
    copy

    $ skillspector scan ./my-skill/ --format json --output report.json && jq '.execution_successful' report.json

    Regenerate a v2 baseline after upgrading from v1 so fingerprint suppressions are accepted again.
    copy

    $ skillspector baseline ./my-skill/ -o .skillspector-baseline.yaml

    Surface ledger exceptions in CI to diagnose why an incomplete scan was blocked.
    copy

    $ skillspector scan ./my-skill/ --format json --output report.json; jq '.analysis_completeness.ledger_exceptions' report.json

    • Adds canonical inspection-ledger accounting across static and LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. analysis stages, including per-component coverage and explicit out-of-scope records.
    • New execution_successful top-level field and analysis_completeness.ledger_exceptions diagnostics in JSON output let automation block incomplete or failed scans.
    • JSON and SARIF reports now include execution-completeness information and analyzer status so a zero-finding report can be distinguished from a partial or failed scan.
    • Recursive scans now propagate child-scan failures to the combined report and return a failure when any child scan fails.
    • CLI now exits with code 2 for fatal execution or accounting failures, even when a JSON report was produced.

    +1 more show less

    • Baseline fingerprints upgraded to version 2 format, binding accepted findings to the scanner version, source content, and full finding evidence.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Baseline files with version 1 fingerprints are no longer accepted; run skillspector baseline <path>, review the generated version 2 entries, and commit the replacement baseline (rules-only version 1 baselines remain supported with a warning).
    • !JSON integrations must treat invalid or missing output, a nonzero process exit, or execution_successful: false as a blocking validation error and surface analysis_completeness.ledger_exceptions for diagnosis.