Issues

• Python AST findings slice the wrong source text after a form feed or U+2028 earlier in the file

  NVIDIA/SkillSpector#1126 · Filter by author 0z5a opened on Nov 14, 2026

• Several guides in docs/ are not linked from the README

  NVIDIA/SkillSpector#1125 · Filter by author adwaitm1301 opened on Nov 14, 2026

• LP4 reports env and file_read as over-declared in Go skills: capability patterns miss os.LookupEnv, os.ReadFile, os.Open

  NVIDIA/SkillSpector#1121 · Filter by author stozo04 opened on Nov 13, 2026
  1

• AR1 fires on a queueing sentence, and RA1 on a consent row and a section heading, in a published skill

  NVIDIA/SkillSpector#1120 · Filter by author HetCreep opened on Nov 13, 2026
  1

• Retain the original input origin in saved scan reports

  NVIDIA/SkillSpector#1116 · Filter by author chrisknvidia opened on Nov 13, 2026
  

• Support custom YARA rules when generating a baseline

  NVIDIA/SkillSpector#1115 · Filter by author chrisknvidia opened on Nov 13, 2026
  

• Static prompt-injection patterns (P1/P3/P4) only match English wording

  NVIDIA/SkillSpector#1113 · Filter by author brissonjo-sudo opened on Nov 13, 2026

• skills/skill-inspector: step 1 reviews the default-branch clone, not the artefact that gets installed

  NVIDIA/SkillSpector#1112 · Filter by author Pantix96 opened on Nov 13, 2026
  1

• bundled_execution_surface: a mod's hooks/hooks.json "modules" entry is not inventoried (opaque without BH1, or SAFE beside an empty "hooks")

  NVIDIA/SkillSpector#1108 · Filter by author lucas-saldanha-werneck opened on Nov 13, 2026
  1

• static_parse_limit (printf_format): printf with a quoted $(printf '%s' "$1" | sed …) argument marks shell scripts partially inspected

  NVIDIA/SkillSpector#1107 · Filter by author lucas-saldanha-werneck opened on Nov 13, 2026
  1

• SC1 reports the requirement ranges inside package-lock.json as unpinned dependencies

  NVIDIA/SkillSpector#1104 · Filter by author DrVelvetFog opened on Nov 12, 2026

• Refactor existing report flow to separate result building from rendering

  NVIDIA/SkillSpector#1099 · Filter by author andreasconrad-ruv opened on Nov 12, 2026

• SC2 misses PowerShell download cradles: IEX (New-Object Net.WebClient).DownloadString(...) and irm | iex scan as SAFE

  NVIDIA/SkillSpector#1096 · Filter by author chiragmangaldev3112 opened on Nov 12, 2026

• E1 misses Ruby and Go HTTP uploads: Net::HTTP.post and http.Post of ~/.ssh/id_rsa get no External Transmission finding

  NVIDIA/SkillSpector#1093 · Filter by author chiragmangaldev3112 opened on Nov 12, 2026

• Add DS5 Java insecure-deserialization detection

  NVIDIA/SkillSpector#1090 · Filter by author devilking7x opened on Nov 11, 2026

• Norton false positive: tests/unit/test_patterns.py flagged as Python:Stealer-IG [Pws]

  NVIDIA/SkillSpector#1088 · Filter by author TychoBrown opened on Nov 11, 2026

• opencode_cli on OpenCode 2.x: the 1.x deny-all policy is ignored; a project opencode.jsonc resolves to deny-all

  NVIDIA/SkillSpector#1084 · Filter by author MJ0006 opened on Nov 10, 2026
  1

• Support a configurable local OSV database for SC4 scans in restricted environments

  NVIDIA/SkillSpector#1083 · Filter by author jh49choi opened on Nov 10, 2026

• _has_shell_execution_call: RegExp .exec() and template arguments to imported helpers mark plain JavaScript as shell-executing (partial coverage, AE1 HIGH)

  NVIDIA/SkillSpector#1071 · Filter by author yunze7373 opened on Nov 9, 2026
  2

• How to use https://github.com/NVIDIA/SkillSpector

  NVIDIA/SkillSpector#1070 · Filter by author dinaluay-cmyk opened on Nov 8, 2026

• TP4 reports a declared workflow's supporting code examples as description-behavior mismatches, at HIGH, and anchors every finding at SKILL.md:1

  NVIDIA/SkillSpector#1066 · Filter by author dzivkovi opened on Nov 6, 2026
  1

• Static analyzers miss Turkish-language prompt injection, with or without Turkish characters (equivalent English samples are flagged)

  NVIDIA/SkillSpector#1046 · Filter by author GeenccMustafa opened on Nov 5, 2026

• Generate multiple report formats from a single scan

  NVIDIA/SkillSpector#1040 · Filter by author andreasconrad-ruv opened on Nov 5, 2026

• Static analyzers miss Polish-language prompt injection, with or without diacritics (equivalent English samples are flagged)

  NVIDIA/SkillSpector#1028 · Filter by author przemyslvw opened on Nov 5, 2026
  3

• static_parse_limit when an inline code span wraps across a line break before a <placeholder>, turning clean Markdown into AE1 HIGH

  NVIDIA/SkillSpector#1023 · Filter by author alexcpn opened on Nov 5, 2026
  1