SkillSpector — The Cyber Toolchain

SkillSpector v2.13.3

Mon, 02 Nov 2026 06:44:11 GMT

SkillSpector adds configurable batch and workflow-deadline limits and now detects writes to agent-memory files and inspects npx commands in JSON MCP configurations⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Control the tool-description comparison batch limit with `SKILLSPECTOR_TP4_MAX_BATCHES` (default 256) and the workflow deadline with `SKILLSPECTOR_MAX_WORKFLOW_SECONDS` (default 1,080 seconds), and honor LLM concurrency via `SKILLSPECTOR_MAX_LLM_CONCURRENCY`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • SkillSpector now inspects `npx` commands in JSON MCP configurations and recognizes additional Claude, Cline, and Roo Code credential and configuration filenames. • SkillSpector now detects writes to known agent-memory files and directories from automatically run test carriers, including raw Windows paths. • SkillSpector adds a bounded YARA signal for nearby directory walking, encryption, and binary writes across lines to surface potential ransomware-like behavior alongside existing stronger rules. • SkillSpector now extracts Pipenv dependencies and checks locked versions, preserving incomplete coverage for malformed or unsupported dependency declarations. • SkillSpector now follows credential reads nested in `urllib` request headers into network sinks. • SkillSpector now rejects baseline and recursive report destinations that would overwrite the primary input or a discovered child skill's input, including file aliases. • SkillSpector now reports incomplete inspection when a requested custom YARA rule directory is unavailable. • Non-English gap-fill findings are now included in contributed batch-scan scores, recommendations, and exit status instead of retaining a stale SAFE verdict. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skillspector

SkillSpector v2.13.1

Fri, 23 Oct 2026 09:40:35 GMT

SkillSpector v2.13.1 hardens atomic report writes, tightens P2 HTML-comment scope, and adds `gap_fill_status` incomplete reporting with exit code 2.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Writes report files (`scan`, `scan --recursive`, `scan --mcp-registry`, and `--output`) and baselines atomically through an already-opened, no-follow parent directory; `skillspector baseline -o -` writes the baseline as JSON to stdout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Rejects `--use-shipped-baseline` with exit code 2 when `scan --recursive` detects one or more child skills, before any report is written. • Rejects `scan --mcp-registry` combined with `--use-shipped-baseline`, `--transitive`, `--transitive-depth`, `--transitive-allow-prefix`, or `--transitive-deny-prefix` with exit code 2 before the registry is read or a report is written. • Reports failed batch gap-fill passes as incomplete with `gap_fill_status: "incomplete"`, failure reasons, and at least a CAUTION recommendation; the batch run exits with code 2. • Keeps each P2 hidden-instruction match inside one HTML comment, including `--!>`, ``, and `` closers, so visible text between comments and words such as `target` or `POSTGRES` are no longer reported as hidden instructions. • Adds a HIGH MP3 finding for an explicit instruction to treat or adopt linked state as the agent's memory or conversation state, unless that instruction is directly prohibited. • Reports a complete recursive scan whose highest score is MEDIUM (21-50) as CAUTION instead of SAFE, matching child reports. Breaking changes: • `scan --recursive` now rejects `--use-shipped-baseline` with exit code 2 when child skills are detected; previously the option was silently ignored. • `scan --mcp-registry` now rejects `--use-shipped-baseline`, `--transitive`, `--transitive-depth`, `--transitive-allow-prefix`, and `--transitive-deny-prefix` with exit code 2; previously these options were silently ignored. • A complete recursive scan with a highest score of MEDIUM (21-50) now exits with CAUTION instead of SAFE. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skillspector

SkillSpector v2.13.0

Fri, 16 Oct 2026 18:09:37 GMT

SkillSpector v2.13.0 hardens MCP access, expands Python/TypeScript/binary detection, and fixes baseline and batch-scan integrity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Restricts MCP HTTP listeners to loopback; remote deployments require an authenticating proxy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds detection for bundled settings that use the short `-r` flag to load and run extra code, and flags bundled settings that run commands, redirect AI traffic, or automatically approve connected tool servers. • Detects encoded shell payloads that are decoded and executed. • Adds lower-confidence warnings for multiline scripts that appear to open a remote shell, while preserving existing one-line detections. • Detects sensitive data passed to `urllib` opener requests, including inline opener calls. • Finds Python flows from secret reads to risky uses even when assignments and uses appear at different nesting depths. • Inspects readable instructions hidden behind binary file prefixes while keeping ordinary PDF/GIF assets and XMP metadata from producing false alarms. • Treats OMS signing bundles as untrusted input, inspecting decoded metadata and preserving raw evidence and incomplete coverage when parsing fails. • Improves executable-file detection by checking complete TypeScript declaration files before treating them as non-executable, so partial or disguised runtime code is not skipped, and by recognizing more executable Python files, including `.pyw` files and extensionless launchers. • Inspects hooks declared in Claude plugin manifests and reports incomplete coverage when those declarations cannot be fully checked. Breaking changes: • The Codex CLI analysis provider is disabled; any workflow relying on it must switch to another supported provider. • MCP HTTP listeners are restricted to loopback; remote MCP deployments that previously accepted direct connections now require an authenticating proxy. • Exact-fingerprint baselines are version-bound and must be regenerated after upgrading to v2.13.0. • NVIDIA Build defaults to GLM-5.3 after retirement of the previous default (GLM-5.2); explicit model overrides remain supported. • Baseline generation uses atomic replacement; updates that cannot preserve ownership or group safely are refused — write a new baseline file instead. • If a real directory ending in `!` collides with an archive-member path, that directory must be renamed to allow both files to be fully inspected. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skillspector

SkillSpector v2.12.0

Wed, 23 Sep 2026 22:28:18 GMT

SkillSpector v2.12.0 adds --fail-on-findings, SC10 supply-chain detection, opencode_cli provider, TP4 Markdown fences, and GitHub tree scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `skillspector scan --fail-on-findings` flag that exits with code 1 when any active finding is present, including findings below the default risk-score threshold, across single-skill, recursive, and MCP registry scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `SKILLSPECTOR_MAX_STATIC_ANALYSIS_SECONDS_PER_ARTIFACT` environment variable to configure static-pattern and YARA time allowance per artifact; default raised from 30 to 300 seconds. • Adds `SKILLSPECTOR_COMPACT_PROMPTS=1` (also `true` / `yes`) to enable shorter unpadded LLM prompt line labels such as `L1:` instead of `L01:`. • Adds `SKILLSPECTOR_PROVIDER=opencode_cli` to run semantic analysis through a local OpenCode login, requiring exactly OpenCode 1.18.31 and failing closed on auth, version, policy, or empty-output failures. • Adds a native `/skillspector` command and `skillspector_scan` tool to OpenCode via the repository-provided `.opencode/` extension; installed by copying `.opencode/` from a checkout, resolved via `SKILLSPECTOR_BIN`, a worktree `.venv`, or `PATH`. • Adds SC10 detection of noncanonical or unresolved dependency sources across npm, Yarn, pip, Poetry, Maven, and Cargo configuration, shell scripts, generated heredocs, and actionable shell fences in `SKILL.md`/`README.md`. • Supports HTTPS GitHub `/tree/` URLs to select a repository subdirectory as scan input, resolving the longest advertised branch/tag name including refs containing slashes. • Registers `gemini-3.5-flash` model budgets for the root and OpenAI-compatible registries, enabling use through the existing `openai` provider. • Extends TP4 semantic analysis to non-empty, closed Markdown/text fences with recognized executable-language labels. • Adds `metadata.llm_provenance` (schema version 1) to JSON reports, recording sanitized model/package/source identity, configured vs. effective providers, and sampling/reasoning controls; `SKILLSPECTOR_BUILD_REVISION` can supply source revision metadata. • Detects reflective Python module lookups and shipped bytecode inside Python environments. • Non-verbose interactive terminal scans now stream graph execution progress, completed analyzer rules, and a discovered-file tree to standard error without affecting machine-readable standard output. • Distinguishes `reference_missing` from `reference_unresolved` in MCP installation decisions, allowing scans whose only caveats are missing references to proceed when all discovered files were inspected. • JSON findings retain each occurrence's own zero-based columns; SARIF emits one-based Unicode-codepoint columns for active and suppressed findings. • CLI-backed providers now honor `SKILLSPECTOR_MODEL_REGISTRY` for per-model context and output-token limits. • GHSA/OSV `MODERATE` severity now maps to `MEDIUM` instead of the previous `LOW`, potentially increasing affected supply-chain risk scores. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skillspector

SkillSpector v2.11.1

Mon, 07 Sep 2026 12:12:02 GMT

SkillSpector v2.11.1 raises the default workflow deadline to 600s and adds `SKILLSPECTOR_MAX_WORKFLOW_SECONDS` to make it configurable. • Adds `SKILLSPECTOR_MAX_WORKFLOW_SECONDS` environment variable to set a custom positive finite aggregate workflow deadline; invalid, zero, negative, infinite, and NaN values fall back to the 600-second default. • Raises the default aggregate end-to-end workflow and transitive traversal deadline from 60 seconds to 600 seconds, preventing larger valid scans from timing out. • Applies the configured deadline consistently across direct CLI, recursive, transitive, and multi-skill analysis paths. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skillspector

SkillSpector v2.11.0

Fri, 28 Aug 2026 07:28:43 GMT

SkillSpector v2.11.0 adds npm lockfile scanning, BH1–BH3 hook/permission findings, and LLM sampling controls via new env vars. • Adds `SKILLSPECTOR_TEMPERATURE` (values `0`–`1`) and `SKILLSPECTOR_SEED` (integers) environment variables for optional LLM sampling control; forwarded to OpenAI-compatible and Azure OpenAI endpoints; leaving either unset preserves provider defaults. • Expands `skillspector scan --help` to list all supported hosted, local, compatible, and CLI-backed LLM providers with their authentication paths. • Introduces BH1–BH3 findings by analyzing `hooks/hooks.json`, `.claude/settings.json`, and `.claude/settings.local.json` for bundled lifecycle hook execution (BH1), directly proven remote transfer of sensitive event or file content (BH2), and broad or ignored project permission surfaces (BH3). • Supports safe file traversal in restricted Linux sandboxes by opening intermediate path components with `O_PATH` where available, without requiring read access to every ancestor directory. Breaking changes: • Existing scans may now report new BH1–BH3 findings for supported bundled hook and settings files (`hooks/hooks.json`, `.claude/settings.json`, `.claude/settings.local.json`); review those findings and use the existing baseline mechanism only after validating the declared execution or permission surface. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skillspector

SkillSpector v2.10.0

Wed, 26 Aug 2026 20:06:26 GMT

SkillSpector v2.10.0 adds transitive scanning, hidden/nested artifact inspection, EA5 detection, and new env var + report field for policy gates. • Adds `--transitive` flag to opt into transitive scanning of referenced skills, with `--transitive-depth`, `--transitive-allow-prefix`, and `--transitive-deny-prefix` controls for bounded traversal. • Adds `SKILLSPECTOR_OUTPUT_LANGUAGE` environment variable to set the language of human-readable LLM-generated finding text. • Adds `risk_assessment.max_issue_severity` field to JSON output (value `NONE` when no active issue is reported) for machine-readable downstream policy gates. • Adds bounded local inspection of hidden files and ZIP-compatible nested artifacts (DOCX, XLSX, PPTX) without extracting or executing members, raising HIGH SC9 findings for concealed executables. • Adds EA5 static findings for external model or provider selection, including silent coding-CLI account switches and top-level model pins. • Adds structured skill summaries for valid AISOP/AISP bundles across terminal, Markdown, JSON, and SARIF output formats. • Adds dynamic analyzer discovery and validates risk-score inputs against the registered analyzer set. • Surfaces partial provider execution and traversal truncation so incomplete deep scans cannot silently appear clean. Breaking changes: • `langgraph-cli[inmem]` is moved from the base installation to the `langgraph-dev` optional extra; LangGraph Studio users who install only the base package must now install `skillspector[langgraph-dev]` explicitly. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skillspector

SkillSpector v2.9.5

Sat, 15 Aug 2026 21:03:32 GMT

SkillSpector v2.9.5 adds Ollama, Azure OpenAI, and generic OpenAI-compatible providers, opt-in `.skillspector-baseline.yaml` auto-discovery, and static detection for insecure deserialization (AST10, TT6, DS1–DS4). • Adds opt-in auto-discovery of a top-level `.skillspector-baseline.yaml` file, keeping explicitly supplied baselines authoritative when both are present. • Adds Ollama support for local OpenAI-compatible inference, Azure OpenAI deployment routing, and a configurable provider for generic OpenAI-compatible endpoints. • Adds static analyzer coverage for insecure deserialization patterns represented by findings AST10, TT6, DS1, DS2, DS3, and DS4. • Switches YARA match-to-source-line mapping to byte offsets so non-ASCII content is reported at accurate locations. • Scopes the destructive-autonomy YARA post-filter to SkillSpector's built-in rule namespace and preserves deterministic built-in rule precedence, preventing custom YARA rules that reuse a built-in rule name from being incorrectly post-filtered. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skillspector

SkillSpector v2.9.4

Thu, 13 Aug 2026 06:25:34 GMT

SkillSpector v2.9.4 adds whitespace-padding prompt-injection detection, Python bytecode supply-chain finding (SC8), and hardens HTTP MCP transport against local-path abuse. • Adds detection for whitespace-padding techniques used to hide prompt-injection instructions in skill content. • Adds a HIGH-severity `SC8` finding when a skill ships Python bytecode or `__pycache__` content, expanding supply-chain coverage. • HTTP MCP transport (`skillspector mcp` with `http` transport) now rejects local filesystem scan targets and local YARA-rule directories, enforcing a security boundary between remote callers and scanner-host paths; `stdio` transport retains full local-scan capability. • Recognises `allowed-tools` as valid least-privilege permission guidance in remediations and documentation. • Ships a new Skill Inspector companion skill guide. Breaking changes: • HTTP MCP clients can no longer scan local filesystem paths or provide local YARA-rule directories; switch to a remote repository or URL for HTTP requests, or use `stdio` transport for local scans. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skillspector

SkillSpector v2.5.2

Tue, 04 Aug 2026 22:38:47 GMT

SkillSpector v2.5.2 adds MCP registry posture scanning and enforces ingest size caps via INGEST_MAX_BYTES and INGEST_MAX_ZIP_MEMBERS. • Enforces `INGEST_MAX_BYTES` (100 MiB) cap on streamed URL downloads, total uncompressed zip size, and post-clone Git repo disk usage, and `INGEST_MAX_ZIP_MEMBERS` (10,000) cap on zip entries — failing closed with `IngestLimitExceededError` on breach. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skillspector

SkillSpector v2.5.1

Fri, 31 Jul 2026 03:13:57 GMT

SkillSpector v2.5.1 adds SKILLSPECTOR_MAX_LLM_CONCURRENCY to throttle async LLM batch requests for rate-limited providers. • Adds `SKILLSPECTOR_MAX_LLM_CONCURRENCY` environment variable to control the default concurrency of asynchronous LLM analyzer batches (default 10; values below 1 clamp to 1; blank or invalid values retain the default). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skillspector

SkillSpector v2.5.0

Mon, 27 Jul 2026 15:48:01 GMT

SkillSpector v2.5.0 adds inspection-ledger reporting with execution-completeness fields in JSON/SARIF and v2 baseline fingerprints. • Adds canonical inspection-ledger accounting across static and LLM analysis stages, including per-component coverage and explicit out-of-scope records. • New `execution_successful` top-level field and `analysis_completeness.ledger_exceptions` diagnostics in JSON output let automation block incomplete or failed scans. • JSON and SARIF reports now include execution-completeness information and analyzer status so a zero-finding report can be distinguished from a partial or failed scan. • Recursive scans now propagate child-scan failures to the combined report and return a failure when any child scan fails. • CLI now exits with code 2 for fatal execution or accounting failures, even when a JSON report was produced. • Baseline fingerprints upgraded to version 2 format, binding accepted findings to the scanner version, source content, and full finding evidence. Breaking changes: • Baseline files with version 1 fingerprints are no longer accepted; run `skillspector baseline `, review the generated version 2 entries, and commit the replacement baseline (rules-only version 1 baselines remain supported with a warning). • JSON integrations must treat invalid or missing output, a nonzero process exit, or `execution_successful: false` as a blocking validation error and surface `analysis_completeness.ledger_exceptions` for diagnosis. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skillspector