Issues

• SC1 reports the requirement ranges inside package-lock.json as unpinned dependencies

  NVIDIA/SkillSpector#1104 · Filter by author DrVelvetFog opened on Nov 12, 2026

• Refactor existing report flow to separate result building from rendering

  NVIDIA/SkillSpector#1099 · Filter by author andreasconrad-ruv opened on Nov 12, 2026

• SC2 misses PowerShell download cradles: IEX (New-Object Net.WebClient).DownloadString(...) and irm | iex scan as SAFE

  NVIDIA/SkillSpector#1096 · Filter by author chiragmangaldev3112 opened on Nov 12, 2026

• E1 misses Ruby and Go HTTP uploads: Net::HTTP.post and http.Post of ~/.ssh/id_rsa get no External Transmission finding

  NVIDIA/SkillSpector#1093 · Filter by author chiragmangaldev3112 opened on Nov 12, 2026

• Add DS5 Java insecure-deserialization detection

  NVIDIA/SkillSpector#1090 · Filter by author devilking7x opened on Nov 11, 2026

• OpenAI-compatible providers send response_format json_schema; gateways without it (DeepSeek) fail every analyzer with HTTP 400

  NVIDIA/SkillSpector#1089 · Filter by author opentekware opened on Nov 11, 2026
  1

• Norton false positive: tests/unit/test_patterns.py flagged as Python:Stealer-IG [Pws]

  NVIDIA/SkillSpector#1088 · Filter by author TychoBrown opened on Nov 11, 2026

• opencode_cli on OpenCode 2.x: the 1.x deny-all policy is ignored; a project opencode.jsonc resolves to deny-all

  NVIDIA/SkillSpector#1084 · Filter by author MJ0006 opened on Nov 10, 2026
  1

• Support a configurable local OSV database for SC4 scans in restricted environments

  NVIDIA/SkillSpector#1083 · Filter by author jh49choi opened on Nov 10, 2026

• Inline HTML or autolink backtick hides a Markdown declared-marker instruction (SAFE)

  NVIDIA/SkillSpector#1081 · Filter by author udsy19 opened on Nov 10, 2026

• uv.lock in v2.13.4 pins langgraph 1.2.6 and langgraph-sdk 0.4.4 (GHSA-3fx2-cqw9-xr3c)

  NVIDIA/SkillSpector#1078 · Filter by author vividkind opened on Nov 9, 2026

• _has_shell_execution_call: RegExp .exec() and template arguments to imported helpers mark plain JavaScript as shell-executing (partial coverage, AE1 HIGH)

  NVIDIA/SkillSpector#1071 · Filter by author yunze7373 opened on Nov 9, 2026
  2

• How to use https://github.com/NVIDIA/SkillSpector

  NVIDIA/SkillSpector#1070 · Filter by author dinaluay-cmyk opened on Nov 8, 2026

• TP4 reports a declared workflow's supporting code examples as description-behavior mismatches, at HIGH, and anchors every finding at SKILL.md:1

  NVIDIA/SkillSpector#1066 · Filter by author dzivkovi opened on Nov 6, 2026
  1

• Static analyzers miss Turkish-language prompt injection, with or without Turkish characters (equivalent English samples are flagged)

  NVIDIA/SkillSpector#1046 · Filter by author GeenccMustafa opened on Nov 5, 2026

• Generate multiple report formats from a single scan

  NVIDIA/SkillSpector#1040 · Filter by author andreasconrad-ruv opened on Nov 5, 2026

• Windows: scan --exclude globs are expanded before parsing (exit 2 or wrong exclusions)

  NVIDIA/SkillSpector#1029 · Filter by author Bortlesboat opened on Nov 5, 2026

• Static analyzers miss Polish-language prompt injection, with or without diacritics (equivalent English samples are flagged)

  NVIDIA/SkillSpector#1028 · Filter by author przemyslvw opened on Nov 5, 2026
  3

• static_parse_limit when an inline code span wraps across a line break before a <placeholder>, turning clean Markdown into AE1 HIGH

  NVIDIA/SkillSpector#1023 · Filter by author alexcpn opened on Nov 5, 2026
  1

• Strict JSON VERSION scalar is misclassified as a missing artifact

  NVIDIA/SkillSpector#1021 · Filter by author 777genius opened on Nov 4, 2026

• SC2 misses downloads executed through command or process substitution

  NVIDIA/SkillSpector#1018 · Filter by author Alvi-Rahman opened on Nov 4, 2026

• skills/skill-inspector step 2 documents an --output command that cannot run on Windows

  NVIDIA/SkillSpector#1015 · Filter by author relaxusltd opened on Nov 4, 2026

• CLI providers: antigravity_cli is disabled on an agy version we could not reproduce it on, and gemini_cli is closed to most individuals; claude_cli works end to end

  NVIDIA/SkillSpector#1013 · Filter by author HetCreep opened on Nov 4, 2026
  4

• Pyproject.toml and Releases are out of sync

  NVIDIA/SkillSpector#1012 · Filter by author andreasconrad-ruv opened on Nov 4, 2026

• pipx install fails on Python 3.14/3.15 because yara-python 4.5.4 has no wheels and its source build fails against OpenSSL 4

  NVIDIA/SkillSpector#1008 · Filter by author ocofaigh opened on Nov 3, 2026
  1