Issues

• RA1 negation exemption treats "never recommend skipping X" as a prohibition of X

  NVIDIA/SkillSpector#956 · Filter by author udsy19 opened on Oct 30, 2026

• Refusing to overwrite error appears after consuming LLM tokens

  NVIDIA/SkillSpector#954 · Filter by author dashingDragon opened on Oct 30, 2026

• Static analyzers miss Chinese-language prompt injection (equivalent English samples are flagged)

  NVIDIA/SkillSpector#953 · Filter by author luxiaoyu-cs opened on Oct 30, 2026

• Inspect locked npm dependency contents as an opt-in scan

  NVIDIA/SkillSpector#951 · Filter by author YMuskrat opened on Oct 29, 2026

• Make TP4 batch capacity configurable for skills with many executable examples

  NVIDIA/SkillSpector#941 · Filter by author mbakman opened on Oct 28, 2026

• Sibling npm lockfiles supply versions to unrelated project manifests

  NVIDIA/SkillSpector#937 · Filter by author chrisknvidia opened on Oct 28, 2026
  

• Support opted-in shipped baselines in local ZIP skill inputs

  NVIDIA/SkillSpector#931 · Filter by author chrisknvidia opened on Oct 28, 2026
  

• Optional AVE ids as SARIF rule tags, starting with SC8 and SC10?

  NVIDIA/SkillSpector#930 · Filter by author chaksaray opened on Oct 28, 2026

• TM1 borrows unsafe flags from later Markdown command examples

  NVIDIA/SkillSpector#927 · Filter by author AgrantNV opened on Oct 28, 2026

• Cross-link suggestion: Independent third-party evaluation

  NVIDIA/SkillSpector#925 · Filter by author LGD-Eval opened on Oct 28, 2026

• LLM stage enabled by default + no provider key = whole scan crashes (exit 2, zero output) for ANY package

  NVIDIA/SkillSpector#908 · Filter by author stwhwing opened on Oct 25, 2026
  1

• static_parse_limit from a backtick-quoted word in a shell comment, or an apostrophe after inline code, turns clean files into AE1 HIGH

  NVIDIA/SkillSpector#901 · Filter by author illyaMs opened on Oct 22, 2026
  1

• E5 labels cloud-to-local downloads as cloud exfiltration

  NVIDIA/SkillSpector#889 · Filter by author chrisknvidia opened on Oct 20, 2026
  1

  

• P5 false positive: aircraft-safety explanation is classified as harmful instructions

  NVIDIA/SkillSpector#887 · Filter by author Ara-Yeroyan opened on Oct 20, 2026

• À

  NVIDIA/SkillSpector#886 · Filter by author Adelo31 opened on Oct 20, 2026

• static_parse_limit: a backtick template literal whose first word holds a non-trivial ${...} is read as a possible printf substitution

  NVIDIA/SkillSpector#884 · Filter by author KazunoriNakajima opened on Oct 20, 2026
  2

• Ordinary prose marks analyzers degraded (obfuscated_instruction_text, static_parse_limit)

  NVIDIA/SkillSpector#868 · Filter by author naamanhirschfeld-armis opened on Oct 18, 2026
  1

• perf: derived text views are rebuilt by every analyzer (no cross-analyzer cache)

  NVIDIA/SkillSpector#867 · Filter by author naamanhirschfeld-armis opened on Oct 18, 2026

• perf: per-character Python loops in the Unicode security view dominate analysis (~20 KB/s)

  NVIDIA/SkillSpector#866 · Filter by author naamanhirschfeld-armis opened on Oct 18, 2026

• perf: the whole LLM stack is imported eagerly (~2 CPU-seconds per process, even for --version and --no-llm)

  NVIDIA/SkillSpector#865 · Filter by author naamanhirschfeld-armis opened on Oct 18, 2026
  1

• TM1 misses shell=True when an earlier argument contains a call (e.g. ' '.join(sys.argv[1:]))

  NVIDIA/SkillSpector#857 · Filter by author udsy19 opened on Oct 17, 2026

• E1 upload matcher borrows flags from independent commands

  NVIDIA/SkillSpector#838 · Filter by author chrisknvidia opened on Oct 14, 2026
  1

  

• PE3 flags .env entries inside ```gitignore code fences in Markdown

  NVIDIA/SkillSpector#830 · Filter by author jwcastillo opened on Oct 14, 2026

• E2 shell arm: known limits of the grep -v exemption after #483

  NVIDIA/SkillSpector#818 · Filter by author MandoCodes1 opened on Oct 12, 2026
  1

• Quote in a heredoc body, comment or prose hides a later command line from the command-word scan

  NVIDIA/SkillSpector#813 · Filter by author elliottwaves-20 opened on Oct 9, 2026
  1