Issues

• SC9 reports every script under .claude/skills/ and .agents/skills/ as a concealed executable (HIGH, confidence 1.0)

  NVIDIA/SkillSpector#732 · Filter by author the-black-beard opened on Oct 5, 2026

• TP4 runs its LLM batches serially and becomes the long tail of the scan

  NVIDIA/SkillSpector#730 · Filter by author elliottwaves-20 opened on Oct 4, 2026

• scan --output can overwrite its local input file

  NVIDIA/SkillSpector#728 · Filter by author YMuskrat opened on Oct 4, 2026

• ZIP inputs with uppercase extensions are not extracted

  NVIDIA/SkillSpector#726 · Filter by author YMuskrat opened on Oct 4, 2026

• Terminal report formatter can crash when displaying literal markup tags

  NVIDIA/SkillSpector#724 · Filter by author YMuskrat opened on Oct 4, 2026

• OpenCode Zen Free-Tier Refusal Under the Deny-All Sandbox (opencode_cli)

  NVIDIA/SkillSpector#715 · Filter by author Yoseph-Zuskin opened on Oct 4, 2026
  1

• TT3: credential sent through urllib.request.build_opener(...).open() is not reported

  NVIDIA/SkillSpector#714 · Filter by author jamesjsanders opened on Oct 3, 2026
  2

• opencode_cli version range 1.18.31-1.18.34

  NVIDIA/SkillSpector#712 · Filter by author Yoseph-Zuskin opened on Oct 3, 2026
  1

• Keep PowerShell embedded-shell analysis and SC8 runtime exhaustion fail-closed

  NVIDIA/SkillSpector#711 · Filter by author SyuanTsai opened on Oct 3, 2026

• Inspect skill image text layers; inventory image references

  NVIDIA/SkillSpector#698 · Filter by author Yoseph-Zuskin opened on Oct 1, 2026
  1

• Fixed 5 s wall-clock cap in dependency_sources makes completeness depend on machine load

  NVIDIA/SkillSpector#696 · Filter by author elliottwaves-20 opened on Sep 30, 2026
  2

• static_parse_limit on valid Rust, Python and POSIX shell source leaves files partially inspected

  NVIDIA/SkillSpector#694 · Filter by author elliottwaves-20 opened on Sep 30, 2026
  3

• nvidia

  NVIDIA/SkillSpector#688 · Filter by author milimohp opened on Sep 29, 2026

• Add Copilot support

  NVIDIA/SkillSpector#680 · Filter by author NamigGadir opened on Sep 29, 2026
  1

• P2 false positives on benign standalone header comments (complete, top-of-file, danger-free)

  NVIDIA/SkillSpector#677 · Filter by author Yoseph-Zuskin opened on Sep 29, 2026
  1

• Align Stage 2 filtering and precision claims with current behavior

  NVIDIA/SkillSpector#675 · Filter by author Spectorian opened on Sep 29, 2026
  1

• PE2 flags chmod 600 and 0644 as privilege escalation

  NVIDIA/SkillSpector#671 · Filter by author Spectorian opened on Sep 29, 2026
  1

• AST4 recommends shell=False when the code already uses it

  NVIDIA/SkillSpector#670 · Filter by author Spectorian opened on Sep 29, 2026
  1

• Trigger and quality-policy checks overinterpret descriptions and tool catalogs

  NVIDIA/SkillSpector#669 · Filter by author Spectorian opened on Sep 29, 2026
  6

• TP4 drops warnings that explain unsafe code examples

  NVIDIA/SkillSpector#668 · Filter by author Spectorian opened on Sep 29, 2026
  1

• Prohibitive/defensive language is flagged as the violation itself (negation-blindness in P6, AS3, RA2, EA2)

  NVIDIA/SkillSpector#652 · Filter by author Dr-RMIT opened on Sep 28, 2026
  2

• Static-pattern false positives found scanning public skills (P2 BOM, RA2 plist, EA3 OFL, plus design-level items)

  NVIDIA/SkillSpector#644 · Filter by author jwcastillo opened on Sep 26, 2026
  3

• RP1 npx pattern matches across line breaks, so a line ending in "npx" plus the next word becomes a command

  NVIDIA/SkillSpector#639 · Filter by author JayOfTheKeyboard opened on Sep 26, 2026
  2

• Static scan misses destructive folder commands and natural-language deletion instructions

  NVIDIA/SkillSpector#618 · Filter by author mohgupta-ship-it opened on Sep 23, 2026
  2

• TT3–TT6 behavioral taint tracking silently drops flows nested two+ AST levels below their sink

  NVIDIA/SkillSpector#610 · Filter by author udsy19 opened on Sep 23, 2026
  2