Issues

risk_assessment can say LOW/SAFE while issues[] contains a HIGH finding, with nothing in the report flagging the disagreement

#397

· Mark2Mac opened

on Aug 18, 2026

PE3 fires HIGH on credential vocabulary in prose: a SKILL.md containing only the word `keyring` is Privilege Escalation

#396

· Mark2Mac opened

on Aug 18, 2026

Coverage is computed but never affects the exit code: a partially-blind scan is indistinguishable from a complete one in CI

#389

· Mark2Mac opened

on Aug 18, 2026

nv_build provider unusable out of the box: default model is EOL, meta-analyzer slot model not served, bundled context length rejected

#388

· Mark2Mac opened

on Aug 17, 2026

SKILLSPECTOR_MAX_LLM_CONCURRENCY does not bound total in-flight LLM requests

#387

· Mark2Mac opened

on Aug 17, 2026

osv_client silently drops 90% of vulnerabilities on packages with many advisories

#386

· Mark2Mac opened

on Aug 17, 2026

[SECURITRY] is_code_example() hard-drops findings from .md files

#373

· nedlir opened

on Aug 14, 2026

Feature request: detect model/provider pins in skill frontmatter

#370

· abek858 opened

on Aug 13, 2026

[SECURITY] SC8 presence check does not fix incomplete skip denylist (CWE-184 / CWE-693) (same class as pycache still applies elsewhere)

#367

· nedlir opened

on Aug 12, 2026

Oversized companion file causes SkillSpector to skip analysis of unrelated skill files (v2.8.2) (another malicious skill example that bypasses this scanner)

#363

· nedlir opened

on Aug 12, 2026

Support configurable output language for LLM analyzer findings (e.g. via env var)

#345

· geosmart opened

on Aug 4, 2026

Can langgraph-cli[inmem] be an optional dependency?

#343

· bevanjkay opened

on Aug 4, 2026

Navigation Menu

Uh oh!

All issues

risk_assessment can say LOW/SAFE while issues[] contains a HIGH finding, with nothing in the report flagging the disagreement

PE3 fires HIGH on credential vocabulary in prose: a SKILL.md containing only the word `keyring` is Privilege Escalation

Coverage is computed but never affects the exit code: a partially-blind scan is indistinguishable from a complete one in CI

nv_build provider unusable out of the box: default model is EOL, meta-analyzer slot model not served, bundled context length rejected

SKILLSPECTOR_MAX_LLM_CONCURRENCY does not bound total in-flight LLM requests

osv_client silently drops 90% of vulnerabilities on packages with many advisories

[SECURITRY] is_code_example() hard-drops findings from .md files

Feature request: detect model/provider pins in skill frontmatter

[SECURITY] SC8 presence check does not fix incomplete skip denylist (CWE-184 / CWE-693) (same class as pycache still applies elsewhere)

Oversized companion file causes SkillSpector to skip analysis of unrelated skill files (v2.8.2) (another malicious skill example that bypasses this scanner)

Support configurable output language for LLM analyzer findings (e.g. via env var)

Can langgraph-cli[inmem] be an optional dependency?

Uh oh!

Search results