Issues

• openai_compatible: no way to use auto tool_choice for endpoints that ignore response_format and forced tool_choice (e.g. iFlytek spark-x2.5)

  NVIDIA/SkillSpector#707 · Filter by author FenjuFu opened on Oct 1, 2026

• Inspect skill image text layers; inventory image references

  NVIDIA/SkillSpector#698 · Filter by author Yoseph-Zuskin opened on Oct 1, 2026

• Fixed 5 s wall-clock cap in dependency_sources makes completeness depend on machine load

  NVIDIA/SkillSpector#696 · Filter by author elliottwaves-20 opened on Sep 30, 2026
  1

• obfuscated_instruction_text on a Docker argv list (--cap-drop) in Python source

  NVIDIA/SkillSpector#695 · Filter by author elliottwaves-20 opened on Sep 30, 2026
  1

• static_parse_limit on valid Rust, Python and POSIX shell source leaves files partially inspected

  NVIDIA/SkillSpector#694 · Filter by author elliottwaves-20 opened on Sep 30, 2026

• nvidia

  NVIDIA/SkillSpector#688 · Filter by author milimohp opened on Sep 29, 2026

• Add Copilot support

  NVIDIA/SkillSpector#680 · Filter by author NamigGadir opened on Sep 29, 2026

• P2 false positives on benign standalone header comments (complete, top-of-file, danger-free)

  NVIDIA/SkillSpector#677 · Filter by author Yoseph-Zuskin opened on Sep 29, 2026

• P9 flags ordinary Markdown table alignment as whitespace padding

  NVIDIA/SkillSpector#676 · Filter by author Spectorian opened on Sep 29, 2026
  1

• Align Stage 2 filtering and precision claims with current behavior

  NVIDIA/SkillSpector#675 · Filter by author Spectorian opened on Sep 29, 2026

• Least-privilege remediation can broaden allowed-tools preapproval

  NVIDIA/SkillSpector#674 · Filter by author Spectorian opened on Sep 29, 2026

• SC4 uses confirmed-vulnerability wording for unknown versions and failed lookups

  NVIDIA/SkillSpector#673 · Filter by author Spectorian opened on Sep 29, 2026

• PE2 flags chmod 600 and 0644 as privilege escalation

  NVIDIA/SkillSpector#671 · Filter by author Spectorian opened on Sep 29, 2026

• AST4 recommends shell=False when the code already uses it

  NVIDIA/SkillSpector#670 · Filter by author Spectorian opened on Sep 29, 2026

• Trigger and quality-policy checks overinterpret descriptions and tool catalogs

  NVIDIA/SkillSpector#669 · Filter by author Spectorian opened on Sep 29, 2026
  5

• TP4 drops warnings that explain unsafe code examples

  NVIDIA/SkillSpector#668 · Filter by author Spectorian opened on Sep 29, 2026

• Meta-review can attach assessments to the wrong finding and misreport review status

  NVIDIA/SkillSpector#667 · Filter by author Spectorian opened on Sep 29, 2026

• Support Bearer auth for the anthropic provider

  NVIDIA/SkillSpector#659 · Filter by author tetreaultmarc opened on Sep 28, 2026

• Baseline generation silently drops findings: dedupe key is coarser than match scope

  NVIDIA/SkillSpector#656 · Filter by author niteshmanav opened on Sep 28, 2026
  

• Prohibitive/defensive language is flagged as the violation itself (negation-blindness in P6, AS3, RA2, EA2)

  NVIDIA/SkillSpector#652 · Filter by author Dr-RMIT opened on Sep 28, 2026
  1

• Static-pattern false positives found scanning public skills (P2 BOM, RA2 plist, EA3 OFL, plus design-level items)

  NVIDIA/SkillSpector#644 · Filter by author jwcastillo opened on Sep 26, 2026
  2

• RP1 npx pattern matches across line breaks, so a line ending in "npx" plus the next word becomes a command

  NVIDIA/SkillSpector#639 · Filter by author JayOfTheKeyboard opened on Sep 26, 2026
  1

• SC2 flags curl ... | python3 -c '<script>' and | python3 -m json.tool as remote code execution (HIGH)

  NVIDIA/SkillSpector#638 · Filter by author JayOfTheKeyboard opened on Sep 26, 2026
  1

• skillspector baseline only suppresses the first occurrence of a repeated finding

  NVIDIA/SkillSpector#630 · Filter by author willryker opened on Sep 24, 2026
  1

• Hooks declared in plugin.json are not analyzed, so a plugin with a prompt-exfiltration hook scans SAFE

  NVIDIA/SkillSpector#629 · Filter by author willryker opened on Sep 24, 2026
  1