Issues

• Sibling npm lockfiles supply versions to unrelated project manifests

  NVIDIA/SkillSpector#937 · Filter by author chrisknvidia opened on Oct 28, 2026
  

• Linked ZIP reports incomplete coverage after its members were inspected

  NVIDIA/SkillSpector#936 · Filter by author chrisknvidia opened on Oct 28, 2026
  

• Recursive report output can overwrite a child skill's primary input

  NVIDIA/SkillSpector#935 · Filter by author chrisknvidia opened on Oct 28, 2026
  

• P2: a metadata-shaped reference title exempts a hidden destination payload

  NVIDIA/SkillSpector#933 · Filter by author udsy19 opened on Oct 28, 2026

• Support opted-in shipped baselines in local ZIP skill inputs

  NVIDIA/SkillSpector#931 · Filter by author chrisknvidia opened on Oct 28, 2026
  

• Optional AVE ids as SARIF rule tags, starting with SC8 and SC10?

  NVIDIA/SkillSpector#930 · Filter by author chaksaray opened on Oct 28, 2026

• RA1 flags a prohibition against recommending self-update as self-modification

  NVIDIA/SkillSpector#928 · Filter by author AgrantNV opened on Oct 28, 2026

• TM1 borrows unsafe flags from later Markdown command examples

  NVIDIA/SkillSpector#927 · Filter by author AgrantNV opened on Oct 28, 2026

• PE3 reports a GLAB_USE_KEYRING configuration string as credential access

  NVIDIA/SkillSpector#926 · Filter by author AgrantNV opened on Oct 28, 2026

• Cross-link suggestion: Independent third-party evaluation

  NVIDIA/SkillSpector#925 · Filter by author LGD-Eval opened on Oct 28, 2026

• LLM stage enabled by default + no provider key = whole scan crashes (exit 2, zero output) for ANY package

  NVIDIA/SkillSpector#908 · Filter by author stwhwing opened on Oct 25, 2026
  1

• static_parse_limit from a backtick-quoted word in a shell comment, or an apostrophe after inline code, turns clean files into AE1 HIGH

  NVIDIA/SkillSpector#901 · Filter by author illyaMs opened on Oct 22, 2026
  1

• E5 labels cloud-to-local downloads as cloud exfiltration

  NVIDIA/SkillSpector#889 · Filter by author chrisknvidia opened on Oct 20, 2026
  1

  

• P5 false positive: aircraft-safety explanation is classified as harmful instructions

  NVIDIA/SkillSpector#887 · Filter by author Ara-Yeroyan opened on Oct 20, 2026

• À

  NVIDIA/SkillSpector#886 · Filter by author Adelo31 opened on Oct 20, 2026

• static_parse_limit: a backtick template literal whose first word holds a non-trivial ${...} is read as a possible printf substitution

  NVIDIA/SkillSpector#884 · Filter by author KazunoriNakajima opened on Oct 20, 2026
  2

• Memory poisoning is scored on the injection text, not the write: a test file that appends to MEMORY.md scores 0/100 SAFE

  NVIDIA/SkillSpector#879 · Filter by author garymike opened on Oct 19, 2026
  5

• MP2 still fires on aligned Markdown tables (same shape as the P9 fix in #681)

  NVIDIA/SkillSpector#870 · Filter by author naamanhirschfeld-armis opened on Oct 18, 2026

• Ordinary prose marks analyzers degraded (obfuscated_instruction_text, static_parse_limit)

  NVIDIA/SkillSpector#868 · Filter by author naamanhirschfeld-armis opened on Oct 18, 2026
  1

• perf: derived text views are rebuilt by every analyzer (no cross-analyzer cache)

  NVIDIA/SkillSpector#867 · Filter by author naamanhirschfeld-armis opened on Oct 18, 2026

• perf: per-character Python loops in the Unicode security view dominate analysis (~20 KB/s)

  NVIDIA/SkillSpector#866 · Filter by author naamanhirschfeld-armis opened on Oct 18, 2026

• perf: the whole LLM stack is imported eagerly (~2 CPU-seconds per process, even for --version and --no-llm)

  NVIDIA/SkillSpector#865 · Filter by author naamanhirschfeld-armis opened on Oct 18, 2026
  1

• TM1 misses shell=True when an earlier argument contains a call (e.g. ' '.join(sys.argv[1:]))

  NVIDIA/SkillSpector#857 · Filter by author udsy19 opened on Oct 17, 2026

• semantic_security_discovery runs its batches one at a time

  NVIDIA/SkillSpector#854 · Filter by author elliottwaves-20 opened on Oct 17, 2026

• LLM batches for large files exceed MAX_INPUT_BYTES on CLI providers, so the scan never reaches a verdict

  NVIDIA/SkillSpector#853 · Filter by author elliottwaves-20 opened on Oct 17, 2026