# How SkillSpector Detects Privilege Escalation Attempts (sudo, credentials, SSH keys)

> SkillSpector detects privilege escalation attempts by analyzing source code for risky sudo, credential, and SSH key usage. Secure your code effectively.

- Repository: [NVIDIA Corporation/SkillSpector](https://github.com/NVIDIA/SkillSpector)
- Tags: deep-dive
- Published: 2026-06-22

---

**SkillSpector detects privilege escalation attempts using a static pattern analyzer that scans source code for three risk categories: broad permission requests, privileged command execution (sudo, su, pkexec), and access to sensitive credential files (SSH keys, cloud tokens).**

NVIDIA's SkillSpector is a security analysis framework designed to identify risks in AI agent skill bundles. Understanding how it detects privilege escalation attempts reveals the static analysis techniques that uncover both intentional privileged operations and accidental credential exposure in automated workflows.

## The Three Pattern Families (PE-1, PE-2, PE-3)

The `static_patterns_privilege_escalation` analyzer in SkillSpector categorizes risks into three distinct families, each targeting a specific attack vector.

### PE-1: Overly Broad Permissions

This pattern identifies requests for excessive access rights that could enable privilege escalation. The analyzer searches for wildcard permission grants and explicit requests for full administrative access.

Key indicators include:
- `permissions: ["*"]`
- `grant me full access`
- Other patterns suggesting unrestricted capability grants

### PE-2: Privileged Command Execution

This family detects direct invocation of system-level privilege escalation commands. The analyzer flags usage of:
- **sudo** and **su** commands
- **pkexec** for policy-based execution
- **chmod +s** for setting SUID bits
- Direct modifications to system files like `/etc/passwd`

Example matches include `sudo apt-get install` and `chmod u+x /etc/passwd`.

### PE-3: Credential File Access

The highest-risk category identifies attempts to read sensitive authentication materials. This pattern targets:
- SSH private keys (`~/.ssh/id_rsa`, `~/.ssh/id_ed25519`)
- Cloud provider credentials (`~/.aws/credentials`, `~/.azure/credentials`)
- Environment files containing secrets (`.env`, `.env.local`)
- Token files and API key storage locations

## Detection Workflow and Implementation

The analyzer operates as a node within SkillSpector's LangGraph workflow. When the CLI executes a scan, the system follows this precise execution path:

1. **Graph Invocation** – The CLI builds a `SkillspectorState` and invokes `graph.invoke(state)` to trigger the analysis pipeline
2. **Static Pattern Registration** – The `static_runner.run_static_patterns` function discovers the privilege escalation module via `sys.modules[__name__]` registration
3. **Regex Scanning** – The `analyze(content, file_path, file_type)` function in [`static_patterns_privilege_escalation.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_privilege_escalation.py) executes `re.finditer` against three compiled pattern lists: `PE1_PATTERNS`, `PE2_PATTERNS`, and `PE3_PATTERNS`
4. **Location Resolution** – Helper functions `get_line_number` and `get_context` from [`common.py`](https://github.com/NVIDIA/SkillSpector/blob/main/common.py) calculate exact line numbers and extract surrounding code snippets
5. **Documentation Filtering** – The `_is_documentation_example` helper rejects matches that appear in code comments, markdown fences, or example blocks containing phrases like "example:" or "# note:"

6. **Finding Generation** – For each valid match, the analyzer creates an `AnalyzerFinding` object containing:
   - `rule_id`: "PE1", "PE2", or "PE3"
   - `message`: Descriptive text like "Sudo/Root Execution"
   - `severity`: LOW, MEDIUM, or **HIGH** (PE-3 files)
   - `confidence`: Score between 0.6 and 0.95 based on pattern specificity
   - `location`: File path and start line
   - `tags`: `PRIVILEGE_ESCALATION` classification
   - `context`: Surrounding source lines

## Code Examples

### Running a Scan from the Command Line

Execute the analyzer against a skill directory using the CLI:

```bash

# Scan a skill directory and output a JSON report

skillspector scan ./my-skill/ --format json --output report.json

```

The resulting JSON contains a `findings` array with privilege escalation detections:

```json
{
  "rule_id": "PE2",
  "message": "Sudo/Root Execution",
  "severity": "MEDIUM",
  "location": { "file": "src/run.py", "start_line": 42 },
  "confidence": 0.8,
  "tags": ["privilege_escalation"],
  "context": "    subprocess.run(['sudo', 'apt-get', 'install', 'curl'])",
  "matched_text": "sudo apt-get install curl"
}

```

### Programmatic Analysis in Python

Import the analyzer directly for custom scanning:

```python
from skillspector.nodes.analyzers.static_patterns_privilege_escalation import analyze

with open("scripts/deploy.sh", "r", encoding="utf-8") as f:
    content = f.read()

findings = analyze(content, file_path="scripts/deploy.sh", file_type="sh")
for f in findings:
    print(f.rule_id, f.message, f.location.start_line, f.confidence)

```

Expected output:

```

PE2 Sudo/Root Execution 23 0.7
PE3 Credential Access 58 0.9

```

### Integrating with Custom Graphs

For advanced use cases, integrate the node into a custom LangGraph workflow:

```python
from skillspector.graph import graph
from skillspector.state import SkillspectorState

state = SkillspectorState(input_path="./my-skill")
result = graph.invoke(state)          # automatically runs the PE node

print(result["report_body"])          # rendered report containing PE findings

```

## Severity Scoring and Confidence Weighting

SkillSpector assigns **HIGH** severity to all PE-3 findings (credential file access) due to the immediate risk of authentication compromise. PE-2 findings (privileged commands) typically receive **MEDIUM** severity, while PE-1 (broad permissions) may range from **LOW** to **MEDIUM** depending on context.

Each regex pattern includes a confidence score between 0.6 and 0.95. Higher scores indicate more specific pattern matches that are less likely to generate false positives. This weighting enables downstream risk ranking, ensuring that hardcoded SSH keys surface more prominently than generic sudo usage in final reports.

## Key Implementation Files

The privilege escalation detection system spans four primary files in the NVIDIA/SkillSpector repository:

- **[`src/skillspector/nodes/analyzers/static_patterns_privilege_escalation.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_patterns_privilege_escalation.py)** – Contains the `PE1_PATTERNS`, `PE2_PATTERNS`, and `PE3_PATTERNS` regex tables and the `analyze()` function implementation
- **[`src/skillspector/nodes/analyzers/static_runner.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_runner.py)** – Orchestrates pattern module discovery and executes `analyze()` for each source file
- **[`src/skillspector/nodes/analyzers/common.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/common.py)** – Provides utility functions `get_context()` and `get_line_number()` used for location tracking
- **[`src/skillspector/graph.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/graph.py)** – Defines the LangGraph workflow that registers and executes the privilege escalation node

## Summary

- SkillSpector uses the **static_patterns_privilege_escalation** analyzer to detect privilege escalation attempts through regex-based static analysis
- The system identifies three risk categories: **PE-1** (broad permissions), **PE-2** (privileged commands), and **PE-3** (credential files)
- Detection occurs in [`static_patterns_privilege_escalation.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_privilege_escalation.py) via the `analyze()` function, which scans raw source text using compiled pattern lists
- **PE-3 findings** (SSH keys, cloud credentials) receive **HIGH** severity with confidence scores ranging from 0.6 to 0.95
- The **documentation filter** (`_is_documentation_example`) reduces false positives by excluding code examples and comments
- Results integrate into JSON and SARIF reports via the LangGraph workflow defined in [`graph.py`](https://github.com/NVIDIA/SkillSpector/blob/main/graph.py)

## Frequently Asked Questions

### What types of privilege escalation attempts does SkillSpector detect?

SkillSpector detects three specific categories via the static pattern analyzer: **PE-1** identifies overly broad permission requests like wildcard grants; **PE-2** catches privileged command execution including sudo, su, pkexec, and chmod +s operations; **PE-3** flags access to sensitive credential files including SSH private keys, AWS credentials, and environment files containing secrets.

### How does SkillSpector reduce false positives from code examples?

The analyzer implements a documentation filter through the `_is_documentation_example` helper function in [`static_patterns_privilege_escalation.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_privilege_escalation.py). This function rejects matches that appear within example code blocks, markdown fences, or comments containing phrases like "example:" or "# note:", ensuring that documentation does not trigger false security alerts.

### What severity level does SkillSpector assign to credential file access?

Access to credential files (PE-3) receives **HIGH** severity classification. This includes patterns matching SSH keys (`~/.ssh/id_rsa`), cloud provider credentials (`~/.aws/credentials`), and environment files. The high severity reflects the immediate security risk of credential exposure compared to medium severity assigned to PE-2 privileged command usage.

### Can I run the privilege escalation analyzer independently of the full scan?

Yes, you can import and execute the analyzer directly in Python. Import `analyze` from `skillspector.nodes.analyzers.static_patterns_privilege_escalation`, pass the file content and metadata, and receive a list of `AnalyzerFinding` objects. This allows integration into custom security pipelines without invoking the full LangGraph workflow.