What Are the Main Categories of Security Issues SkillSpector Scans For?

SkillSpector examines AI agent skill bundles for two broad categories of security issues: static pattern-based vulnerabilities (detecting concrete code patterns like tool misuse, prompt injection, and supply chain risks) and semantic LLM-based risks (identifying malicious intent, policy violations, and unsafe developer practices).

NVIDIA's SkillSpector is an open-source security scanner designed specifically for AI agent skill bundles. Understanding the specific categories of security issues SkillSpector scans for helps developers harden their agents against both concrete code exploits and high-level behavioral vulnerabilities.

Static Pattern Analysis Categories

The static analyzers use regular expressions and pattern matching to detect known-dangerous constructs in skill code. According to the source code in src/skillspector/nodes/analyzers/pattern_defaults.py, these patterns map to specific identifiers (such as SC4, OH2, LP2) that appear in SARIF reports.

Tool Misuse

The tool misuse detector flags commands or API calls that attempt to bypass safety validations or disable security controls. This category catches patterns like "disable security" or "bypass validation" in tool invocations.

Key file: [static_patterns_tool_misuse.py](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_patterns_tool_misuse.py)

Prompt Injection

This category identifies instructions embedded in prompts that attempt to override system constraints or ignore safety guardrails. The analyzer searches for patterns indicating jailbreak attempts or constraint bypasses.

Key file: [static_patterns_prompt_injection.py](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_patterns_prompt_injection.py)

Memory Poisoning

Memory poisoning detection flags code patterns that attempt to corrupt runtime memory or inject malicious fragments into the agent's context window. This includes patterns that manipulate internal state buffers.

Key file: [static_patterns_memory_poisoning.py](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_patterns_memory_poisoning.py)

Output Handling (Cross-Context Leakage)

Identified in reports as OH2, this category warns when output from one security domain is reused in another without proper sanitization. It prevents scenarios where sensitive data or unsafe command output leaks across trust boundaries.

Key file: [static_patterns_output_handling.py](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_patterns_output_handling.py)

Privilege Escalation

Flagged as LP2 in pattern defaults, this detector identifies wildcard permissions (e.g., "*") and other constructs that grant overly broad access rights. It catches attempts to elevate the agent's privileges beyond intended scopes.

Key file: [static_patterns_privilege_escalation.py](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_patterns_privilege_escalation.py)

Supply Chain Security

This category covers dependency-related risks, specifically:

• SC4: Known vulnerable dependencies (CVEs)
• SC5: Abandoned or unmaintained packages

The analyzer checks requirements.txt and import statements against vulnerability databases.

Key file: [static_patterns_supply_chain.py](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_patterns_supply_chain.py)

Rogue Agent (Obfuscation)

Marked as SC3 in the pattern mapping, this detects code that attempts to hide malicious behavior, self-modify, or establish unauthorized persistence. It catches obfuscation patterns and unauthorized agent initialization.

Key file: [static_patterns_rogue_agent.py](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_patterns_rogue_agent.py)

Excessive Agency

This category flags constructs that grant the skill unchecked autonomy, such as "run arbitrary commands" or unconstrained execution blocks that could lead to unintended side effects.

Key file: [static_patterns_excessive_agency.py](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_patterns_excessive_agency.py)

Data Exfiltration

Detects patterns that attempt to read sensitive files or transmit data to external endpoints outside the intended environment. This includes unauthorized network calls and file system access outside the sandbox.

Key file: [static_patterns_data_exfiltration.py](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_patterns_data_exfiltration.py)

Harmful Content

Identifies references to illicit or dangerous material, including instructions for creating weapons, malware, or other harmful outputs that violate safety policies.

Key file: [static_patterns_harmful_content.py](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_patterns_harmful_content.py)

System Prompt Leakage

Detects accidental exposure of system prompt text or template variables that could reveal the LLM's guardrails or internal instructions to end users.

Key file: [static_patterns_system_prompt_leakage.py](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_patterns_system_prompt_leakage.py)

Semantic Analysis Categories

Beyond static patterns, SkillSpector uses LLM-based semantic analyzers to evaluate intent and policy compliance. These categories assess the skill's behavior and design rather than specific code signatures.

Security Discovery

The semantic security discovery analyzer examines the skill's wording and logic to surface intent-based attack vectors, such as instructions that implicitly describe how to bypass authentication or exploit systems.

Key file: [semantic_security_discovery.py](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/semantic_security_discovery.py)

Quality Policy Compliance

This category verifies that the skill respects defined security policies and does not report issues already covered by static scanners. It ensures semantic findings complement rather than duplicate static analysis.

Key file: [semantic_quality_policy.py](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/semantic_quality_policy.py)

Developer Intent Analysis

Evaluates whether the developer's stated intent aligns with safe practices, flagging mismatches where the implementation suggests malicious purposes despite benign documentation (or vice versa).

Key file: [semantic_developer_intent.py](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/semantic_developer_intent.py)

How SkillSpector Reports Findings

SkillSpector aggregates findings from both static and semantic categories into structured outputs. The tool uses LangGraph workflows defined in [graph.py](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/graph.py) to orchestrate the analysis pipeline, while [report.py](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/report.py) formats results.

Run a scan from the command line:

# Scan a skill directory and output markdown

skillspector scan ./my_skill \
  --output markdown \
  --risk-score

Sample output showing multiple categories:

## Security Findings (Risk Score: 7.4)

- **SC4** – Dependency `vulnerable-lib` has known CVE-2024-12345
- **LP2** – Permission list contains wildcard "*"
- **OH2** – Shell output reused without sanitization
- **Semantic security discovery** – Intent to "bypass authentication" detected

For CI/CD integration, export to SARIF format:

skillspector scan ./my_skill --output sarif > results.sarif

The [pattern_defaults.py](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/pattern_defaults.py) file serves as the central registry mapping pattern IDs (like SC4, OH2, LP2) to human-readable descriptions and severity levels.

Summary

• SkillSpector scans for static pattern vulnerabilities (code-level) and semantic risks (intent-level).
• Static categories include tool misuse, prompt injection, memory poisoning, output handling (OH2), privilege escalation (LP2), supply chain (SC4, SC5), rogue agent (SC3), excessive agency, data exfiltration, harmful content, and system prompt leakage.
• Semantic categories include security discovery, quality policy compliance, and developer intent analysis.
• Pattern IDs like SC4, OH2, and LP2 are defined in pattern_defaults.py and referenced across analyzer modules.
• Results export to SARIF, markdown, JSON, or terminal formats via the CLI in cli.py.

Frequently Asked Questions

What do the pattern IDs like SC4 and OH2 mean in SkillSpector reports?

These IDs map to specific security categories defined in src/skillspector/nodes/analyzers/pattern_defaults.py. For example, SC4 indicates a known vulnerable dependency, OH2 flags cross-context output handling issues, and LP2 marks wildcard permission patterns that could lead to privilege escalation.

How does SkillSpector differ from traditional static analysis tools?

Unlike traditional SAST tools that only look for code signatures, SkillSpector combines static pattern matching with LLM-based semantic analysis. The semantic analyzers evaluate developer intent and policy compliance, catching higher-level risks that regex patterns cannot detect.

Can SkillSpector detect supply chain vulnerabilities in Python dependencies?

Yes. The supply chain analyzer (static_patterns_supply_chain.py) specifically checks for vulnerable packages (SC4) and abandoned dependencies (SC5) by inspecting requirements.txt and import statements against vulnerability databases.

Which file controls how SkillSpector categorizes and describes security findings?

The src/skillspector/nodes/analyzers/pattern_defaults.py file contains the central mapping of pattern IDs to human-readable descriptions, categories, and severity levels. This file ensures consistent categorization across the static analysis modules.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}