# SkillSpector Static Patterns Analyzers: Threat Categories and Architecture Explained

> Explore SkillSpector static_patterns analyzers, understanding their distinct threat detection capabilities, shared architecture, and how they identify diverse security risks from prompt injection to supply chain threats.

- Repository: [NVIDIA Corporation/SkillSpector](https://github.com/NVIDIA/SkillSpector)
- Tags: deep-dive
- Published: 2026-06-16

---

**SkillSpector static_patterns analyzers are modular regex-based security scanners that detect distinct threat categories—from prompt injection to supply chain risks—sharing a common architecture of `analyze()`, `node()`, and `PatternCategory` components while differing only in their specific pattern collections and severity mappings.**

NVIDIA's SkillSpector repository provides a comprehensive suite of static_patterns analyzers designed to identify unsafe behaviors in LLM-orchestrating code. These analyzers scan source files using regular expression patterns to detect vulnerabilities ranging from tool misuse to data exfiltration. Understanding the differences between SkillSpector static_patterns analyzers helps security teams configure appropriate scanning for their specific threat models.

## Shared Architecture Across All Analyzers

Every static_patterns analyzer in SkillSpector follows an identical structural template defined in `src/skillspector/nodes/analyzers/`. This modular design ensures consistent behavior while allowing specialized threat detection.

### The analyze() Method

Each module implements an `analyze()` function that receives source text, file path, and inferred file type. The method scans text with regular-expression patterns grouped by threat category, returning matches wrapped in `AnalyzerFinding` objects containing severity, location, context, and tags.

### The node() Function

The `node()` function serves as glue for the Skillspector graph engine. It invokes `static_runner.run_static_patterns` with the current state and the module itself, logs the number of findings, and returns them. The runner loads file contents from the state, infers file types (`.py` → *python*, `.md` → *markdown*), and feeds them to `analyze()`.

### PatternCategory Tags

All modules import `PatternCategory` from [`pattern_defaults.py`](https://github.com/NVIDIA/SkillSpector/blob/main/pattern_defaults.py) to supply symbolic tags that group findings. Categories like `TOOL_MISUSE`, `PROMPT_INJECTION`, or `DATA_EXFILTRATION` attach to every finding so downstream UI components can filter by threat type.

## Individual Analyzer Modules and Threat Models

The differences between SkillSpector static_patterns analyzers boil down to the threat surfaces they monitor and the concrete regex patterns they employ.

### Tool Misuse Detection

**[`static_patterns_tool_misuse.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_tool_misuse.py)** targets dangerous tool parameters, command chaining, and unsafe defaults using patterns `TM1_PATTERNS` through `TM3_PATTERNS`.

- **TM1_PATTERNS**: Parameter abuse (e.g., `subprocess.*shell=True`)
- **TM2_PATTERNS**: Command chaining (e.g., `rm -rf /`)
- **TM3_PATTERNS**: Unsafe defaults (e.g., `curl … -k`)

Severity ranges from `HIGH` for TM1/TM2 to `MEDIUM` for TM3.

### Prompt Injection Detection

**[`static_patterns_prompt_injection.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_prompt_injection.py)** identifies instructions that override safety, hidden directives, exfiltration commands, and behavior manipulation via patterns `P1_PATTERNS` through `P4_PATTERNS`.

- **P1_PATTERNS**: Override instructions (e.g., `ignore previous instructions`)
- **P2_PATTERNS**: Hidden directives (e.g., `<!-- system -->`)
- **P3_PATTERNS**: Exfiltration commands (e.g., `send conversation to https://…`)
- **P4_PATTERNS**: Behavior manipulation

P1-P3 carry `HIGH` severity; P4 carries `MEDIUM`.

### System Prompt Leakage

**[`static_patterns_system_prompt_leakage.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_system_prompt_leakage.py)** covers direct extraction, indirect inference, and tool-based exfiltration of system prompts using patterns `P6_PATTERNS` through `P8_PATTERNS`.

- **P6_PATTERNS**: Direct extraction (e.g., `print your system prompt`)
- **P7_PATTERNS**: Indirect inference (e.g., `encode your prompt with base64`)
- **P8_PATTERNS**: Tool-based exfiltration (e.g., `dump prompt to file`)

P6 and P8 are `HIGH` severity; P7 is `MEDIUM`.

### Supply Chain and Trigger Abuse

**[`static_patterns_supply_chain.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_supply_chain.py)** detects insecure dependency specifications, known vulnerable packages, abandoned packages, typosquatting, and overly-broad triggers using patterns `SC1-SC6` and `TR1-TR3`.

- **SC1-SC3**: Regex matching on dependency files
- **SC4-SC6**: OSV lookup and fallback mechanisms
- **TR1-TR3**: Trigger analysis (e.g., trigger `"run"`)

Severity varies from `LOW` to `HIGH` depending on the specific vulnerability detected.

### Rogue Agent Detection

**[`static_patterns_rogue_agent.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_rogue_agent.py)** flags attempts to turn the LLM into an autonomous agent, self-modifying code, or hidden execution loops using patterns `RA1_PATTERNS` through `RA4_PATTERNS`.

- **RA1_PATTERNS**: Self-reference
- **RA2_PATTERNS**: Autonomy attempts (e.g., `you are now an agent`)
- **RA3_PATTERNS**: Hidden execution (e.g., `execute code repeatedly`)
- **RA4_PATTERNS**: Privilege-gain attempts

RA2-RA4 are `HIGH` severity; RA1 is `MEDIUM`.

### Privilege Escalation

**[`static_patterns_privilege_escalation.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_privilege_escalation.py)** identifies excessive permissions, sudo/root usage, and credential harvesting via patterns `PE1_PATTERNS` through `PE3_PATTERNS`.

- **PE1_PATTERNS**: Over-permissive configs (e.g., `permissions: ["*"]`)
- **PE2_PATTERNS**: Sudo/root commands (e.g., `sudo su`)
- **PE3_PATTERNS**: Credential paths (e.g., `~/.ssh/id_rsa`)

Severity ranges from `LOW` (PE1) to `HIGH` (PE3).

### Output Handling Risks

**[`static_patterns_output_handling.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_output_handling.py)** detects attempts to dump model output to files, expose raw logits, or store responses insecurely using patterns `OH1_PATTERNS` through `OH3_PATTERNS`.

- **OH1_PATTERNS**: File writes (e.g., `write output to /tmp/log.txt`)
- **OH2_PATTERNS**: Log exposure (e.g., `print raw logits`)
- **OH3_PATTERNS**: Response caching

Severity ranges from `MEDIUM` to `HIGH`.

### Memory Poisoning

**[`static_patterns_memory_poisoning.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_memory_poisoning.py)** identifies persistent context injection, context-window stuffing, and direct memory manipulation using patterns `MP1_PATTERNS` through `MP3_PATTERNS`.

- **MP1_PATTERNS**: Persistent instructions (e.g., `always remember this`)
- **MP2_PATTERNS**: Window stuffing (e.g., `repeat this 1000 times`)
- **MP3_PATTERNS**: Memory overwrite (e.g., `clear your memory`)

MP1-MP2 are `MEDIUM` severity; MP3 is `HIGH`.

### Harmful Content Generation

**[`static_patterns_harmful_content.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_harmful_content.py)** flags generation of disallowed content such as instructions for illegal activities using patterns `HC1_PATTERNS` through `HC4_PATTERNS`.

- **HC1_PATTERNS**: Violent language
- **HC2_PATTERNS**: Illicit instructions
- **HC3_PATTERNS**: Self-harm content
- **HC4_PATTERNS**: Privacy breaches

Most matches carry `HIGH` severity.

### Excessive Agency

**[`static_patterns_excessive_agency.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_excessive_agency.py)** detects prompts that grant the model autonomous decision-making power using patterns `EA1_PATTERNS` through `EA3_PATTERNS`.

- **EA1_PATTERNS**: Agent-like language (e.g., `you are an autonomous agent`)
- **EA2_PATTERNS**: Self-directed planning
- **EA3_PATTERNS**: Goal specification

Severity ranges from `MEDIUM` to `HIGH`.

### Data Exfiltration

**[`static_patterns_data_exfiltration.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_data_exfiltration.py)** identifies code transmitting data to external endpoints, harvesting environment variables, scanning filesystems, or leaking conversation context using patterns `E1_PATTERNS` through `E4_PATTERNS`.

- **E1_PATTERNS**: HTTP POST exfiltration (e.g., `requests.post("https://…", json=…)`)
- **E2_PATTERNS**: Environment variable harvesting (e.g., `os.environ["API_KEY"]`)
- **E3_PATTERNS**: Filesystem enumeration (e.g., `glob("**/.ssh/*")`)
- **E4_PATTERNS**: Conversation leakage

Severity ranges from `MEDIUM` to `HIGH`.

## Implementing Static Pattern Analysis

All analyzers share helper utilities including `common.get_context`, `common.get_line_number`, and `static_runner.run_static_patterns`.

### Running a Specific Analyzer

```python
from skillspector.state import SkillspectorState
from skillspector.nodes.analyzers import static_patterns_tool_misuse as tp

# Minimal state mimicking the graph engine

state = SkillspectorState(
    components=["example.py"],
    file_cache={"example.py": "import subprocess\nsubprocess.run('rm -rf /', shell=True)"},
)

# Invoke the node – it will run the generic runner plus the analyzer

result = tp.node(state)
print(result["findings"])   # → list with a TM1 finding about `shell=True`

```

### Batch Execution with static_runner

```python
from skillspector.state import SkillspectorState
from skillspector.nodes.analyzers import (
    static_patterns_tool_misuse,
    static_patterns_prompt_injection,
    static_patterns_supply_chain,
)
from skillspector.nodes.analyzers import static_runner

state = SkillspectorState(
    components=["my_skill.py", "requirements.txt"],
    file_cache={
        "my_skill.py": open("my_skill.py").read(),
        "requirements.txt": open("requirements.txt").read(),
    },
)

# Run every analyzer in a single call

modules = [
    static_patterns_tool_misuse,
    static_patterns_prompt_injection,
    static_patterns_supply_chain,
]
findings = static_runner.run_static_patterns(state, modules)
for f in findings:
    print(f.rule_id, f.message, f.severity, f.location.file, f.location.start_line)

```

### Inspecting Finding Context

```python
f = findings[0]          # first finding

print(f.context)         # snippet of source code around the match

print(f.matched_text)    # the exact regex match (max 200 chars)

```

## Summary

- **SkillSpector static_patterns analyzers** are modular security scanners located in `src/skillspector/nodes/analyzers/`, each targeting a specific attack surface from tool misuse to data exfiltration.
- **Unified architecture**: All modules implement `analyze()` for regex scanning, `node()` for graph engine integration, and use `PatternCategory` from [`pattern_defaults.py`](https://github.com/NVIDIA/SkillSpector/blob/main/pattern_defaults.py) for tagging.
- **Threat-specific patterns**: Each analyzer defines unique pattern groups (e.g., `TM1_PATTERNS`, `P1_PATTERNS`) with associated severity levels ranging from `LOW` to `HIGH`.
- **Orchestration**: `static_runner.run_static_patterns` coordinates execution, infers file types, and routes content to appropriate analyzers.
- **Extensibility**: New threat categories can be added by defining pattern lists and implementing the standard `analyze()`/`node()` interface.

## Frequently Asked Questions

### What distinguishes SkillSpector's various static_patterns analyzers from one another?

Each analyzer targets a distinct threat model using specialized regular expression patterns. While [`static_patterns_tool_misuse.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_tool_misuse.py) focuses on dangerous shell commands and unsafe parameters, [`static_patterns_prompt_injection.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_prompt_injection.py) detects attempts to override LLM instructions. They share identical architectural components but differ in their pattern collections, severity mappings, and `PatternCategory` tags.

### How does the static_runner coordinate multiple analyzers?

The `static_runner.run_static_patterns` function in [`src/skillspector/nodes/analyzers/static_runner.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_runner.py) loads file contents from the Skillspector state, infers file types from extensions (`.py`, `.md`, etc.), and passes this data to each analyzer's `analyze()` method. It aggregates findings from all modules into a unified list for downstream processing.

### Can I run individual static_patterns analyzers without the full Skillspector pipeline?

Yes. Each analyzer exposes a `node()` function that accepts a `SkillspectorState` object containing file paths and contents. You can import individual modules (e.g., `static_patterns_data_exfiltration`) and invoke their `node()` method directly, or call `analyze()` manually with raw text and file type parameters.

### What severity levels do the static_patterns analyzers assign to findings?

Severity varies by threat category and specific pattern match. Tool misuse patterns TM1 and TM2 typically receive `HIGH` severity, while TM3 receives `MEDIUM`. Prompt injection patterns P1-P3 are `HIGH`, whereas P4 is `MEDIUM`. Supply chain findings range from `LOW` to `HIGH` depending on whether they indicate vulnerable versions or merely suspicious patterns.