Issues

• PooledChatModel leaks API-key slots on client construction failures and cancellation

  NVIDIA/SkillSpector#760 · Filter by author YMuskrat opened on Oct 5, 2026

• Compacted findings reuse another occurrence’s source snippet in reports

  NVIDIA/SkillSpector#759 · Filter by author YMuskrat opened on Oct 5, 2026

• SARIF artifact URIs do not encode literal filename characters

  NVIDIA/SkillSpector#757 · Filter by author YMuskrat opened on Oct 5, 2026

• Registry scans can overwrite their input or comparison report

  NVIDIA/SkillSpector#756 · Filter by author YMuskrat opened on Oct 5, 2026

• Batch scanner mixes progress messages into JSON stdout

  NVIDIA/SkillSpector#753 · Filter by author YMuskrat opened on Oct 5, 2026

• False positive: info_stealer $browser_cookies matches prose that mentions cookies and Edge on one line

  NVIDIA/SkillSpector#751 · Filter by author elliottwaves-20 opened on Oct 5, 2026

• taint tracking: keep a set of sources per name so reassignment can't drop the stronger TT rule

  NVIDIA/SkillSpector#750 · Filter by author udsy19 opened on Oct 5, 2026

• SC9 reports every script under .claude/skills/ and .agents/skills/ as a concealed executable (HIGH, confidence 1.0)

  NVIDIA/SkillSpector#732 · Filter by author the-black-beard opened on Oct 5, 2026
  1

• Terminal report formatter can crash when displaying literal markup tags

  NVIDIA/SkillSpector#724 · Filter by author YMuskrat opened on Oct 4, 2026

• TT3: credential sent through urllib.request.build_opener(...).open() is not reported

  NVIDIA/SkillSpector#714 · Filter by author jamesjsanders opened on Oct 3, 2026
  2

• opencode_cli version range 1.18.31-1.18.34

  NVIDIA/SkillSpector#712 · Filter by author Yoseph-Zuskin opened on Oct 3, 2026
  1

• Keep PowerShell embedded-shell analysis and SC8 runtime exhaustion fail-closed

  NVIDIA/SkillSpector#711 · Filter by author SyuanTsai opened on Oct 3, 2026

• Inspect skill image text layers; inventory image references

  NVIDIA/SkillSpector#698 · Filter by author Yoseph-Zuskin opened on Oct 1, 2026
  1

• static_parse_limit on valid Rust, Python and POSIX shell source leaves files partially inspected

  NVIDIA/SkillSpector#694 · Filter by author elliottwaves-20 opened on Sep 30, 2026
  4

• nvidia

  NVIDIA/SkillSpector#688 · Filter by author milimohp opened on Sep 29, 2026

• Add Copilot support

  NVIDIA/SkillSpector#680 · Filter by author NamigGadir opened on Sep 29, 2026
  1

• P2 false positives on benign standalone header comments (complete, top-of-file, danger-free)

  NVIDIA/SkillSpector#677 · Filter by author Yoseph-Zuskin opened on Sep 29, 2026
  1

• AST4 recommends shell=False when the code already uses it

  NVIDIA/SkillSpector#670 · Filter by author Spectorian opened on Sep 29, 2026
  1

• Trigger and quality-policy checks overinterpret descriptions and tool catalogs

  NVIDIA/SkillSpector#669 · Filter by author Spectorian opened on Sep 29, 2026
  6

• TP4 drops warnings that explain unsafe code examples

  NVIDIA/SkillSpector#668 · Filter by author Spectorian opened on Sep 29, 2026
  1

• Prohibitive/defensive language is flagged as the violation itself (negation-blindness in P6, AS3, RA2, EA2)

  NVIDIA/SkillSpector#652 · Filter by author Dr-RMIT opened on Sep 28, 2026
  2

• Static-pattern false positives found scanning public skills (P2 BOM, RA2 plist, EA3 OFL, plus design-level items)

  NVIDIA/SkillSpector#644 · Filter by author jwcastillo opened on Sep 26, 2026
  3

• RP1 npx pattern matches across line breaks, so a line ending in "npx" plus the next word becomes a command

  NVIDIA/SkillSpector#639 · Filter by author JayOfTheKeyboard opened on Sep 26, 2026
  2

• Static scan misses destructive folder commands and natural-language deletion instructions

  NVIDIA/SkillSpector#618 · Filter by author mohgupta-ship-it opened on Sep 23, 2026
  2

• Bitcoin funding documentation matches ransomware_behavior

  NVIDIA/SkillSpector#606 · Filter by author cashton-coleman opened on Sep 22, 2026
  3