# How Executable Scripts Affect SkillSpector's Risk Score: The 1.3× Multiplier Explained

> Discover how executable scripts increase SkillSpector's risk score by 1.3x. Learn how this multiplier impacts skill severity for NVIDIA/SkillSpector.

- Repository: [NVIDIA Corporation/SkillSpector](https://github.com/NVIDIA/SkillSpector)
- Tags: deep-dive
- Published: 2026-06-14

---

**Executable scripts trigger a 1.3× multiplier on SkillSpector's risk score, increasing the final calculated value by up to 30% and potentially escalating a skill into a higher severity category.**

NVIDIA's SkillSpector evaluates AI skills for security vulnerabilities by calculating a numerical risk score from 0 to 100. The presence of executable scripts in a skill's component metadata significantly amplifies this score through a specific multiplier applied during the final reporting phase.

## How SkillSpector Calculates Base Risk Scores

Before applying multipliers, SkillSpector sums severity-weighted findings according to fixed rules defined in [`src/skillspector/nodes/report.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/report.py). Each detected finding contributes to a raw total based on its severity level:

- **CRITICAL**: +50 points
- **HIGH**: +25 points  
- **MEDIUM**: +10 points
- **LOW**: +5 points

This summation occurs in the `_compute_risk_score` function between lines 74 and 92, producing a base score that reflects the cumulative security impact of all detected issues.

## The 1.3× Executable Script Multiplier

When `has_executable_scripts` evaluates to `True` in the component metadata, SkillSpector applies a **1.3× multiplier** to the base score. This calculation is implemented in [`src/skillspector/nodes/report.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/report.py) at lines 92-95:

```python

# Logic from src/skillspector/nodes/report.py#L92-L95

if has_executable_scripts:
    total_score = min(100, int(total_score * 1.3))

```

The `min(100, ...)` operation ensures the final score never exceeds the 100-point maximum, effectively capping the multiplier's effect while preserving the proportional increase for lower scores.

## Real-World Impact on Severity Classification

The 30% increase from executable scripts can shift a skill across severity boundaries, altering the recommended action. For example, two HIGH-severity findings generate a base score of 50. Without executable scripts, this remains at 50 points with a **HIGH** severity classification. With executable scripts detected, the calculation becomes:

```

50 × 1.3 = 65 points

```

As confirmed in [`tests/nodes/test_report.py`](https://github.com/NVIDIA/SkillSpector/blob/main/tests/nodes/test_report.py) (lines 100-108), this elevated score remains within the HIGH band but pushes the skill closer to the CRITICAL threshold. In scenarios where a base score of 40 (MEDIUM) receives the multiplier, the result of 52 points escalates the classification to **HIGH**, potentially changing the recommendation from *CAUTION* to *DO_NOT_INSTALL*.

## Code Example: Computing Scores With and Without Scripts

The following demonstration uses SkillSpector's internal `_compute_risk_score` function to illustrate the multiplier's effect:

```python
from skillspector.nodes.report import _compute_risk_score
from skillspector.models import Finding

# Two HIGH-severity findings → base score 50

findings = [
    Finding(rule_id="E2", severity="HIGH", message="Unsafe exec", file="run.py", start_line=1, end_line=5),
    Finding(rule_id="PE3", severity="HIGH", message="Dynamic import", file="run.py", start_line=6, end_line=10),
]

# Without executable scripts: score remains 50

score, severity, recommendation = _compute_risk_score(findings, has_executable_scripts=False)
print(f"Score: {score}, Severity: {severity}")  # Score: 50, Severity: HIGH

# With executable scripts: 50 × 1.3 = 65

score, severity, recommendation = _compute_risk_score(findings, has_executable_scripts=True)
print(f"Score: {score}, Severity: {severity}")  # Score: 65, Severity: HIGH

```

## Verification in the Test Suite

The multiplier behavior is explicitly validated in [`tests/nodes/test_report.py`](https://github.com/NVIDIA/SkillSpector/blob/main/tests/nodes/test_report.py). The test constructs a state with executable script metadata and verifies the mathematical outcome:

```python
def test_report_executable_scripts_multiplier():
    """has_executable_scripts applies 1.3x to risk score (capped at 100)."""
    state = {
        "filtered_findings": [
            {"rule_id": "E2", "severity": "HIGH"},
            {"rule_id": "PE3", "severity": "HIGH"}
        ],
        "component_metadata": [{"path": "run.py", "type": "python", 
                              "lines": 5, "executable": True, "size_bytes": 200}],
        "has_executable_scripts": True,
        "output_format": "json",
    }
    result = report(state)
    assert result["risk_score"] == 65  # 50 × 1.3 = 65

```

This test confirms that the `has_executable_scripts` flag, derived from component metadata in [`src/skillspector/state.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/state.py), directly influences the final risk output.

## Summary

- Executable scripts in SkillSpector trigger a **1.3× multiplier** on the calculated risk score.
- The multiplier is applied in [`src/skillspector/nodes/report.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/report.py) after summing severity-weighted findings (CRITICAL +50, HIGH +25, MEDIUM +10, LOW +5).
- Final scores are **capped at 100 points** to prevent overflow beyond the defined range.
- A 30% increase can elevate a skill's severity band, changing installation recommendations from *CAUTION* to *DO_NOT_INSTALL*.
- The logic is verified by unit tests in [`tests/nodes/test_report.py`](https://github.com/NVIDIA/SkillSpector/blob/main/tests/nodes/test_report.py) demonstrating the mathematical calculation on real finding data.

## Frequently Asked Questions

### How much do executable scripts increase the SkillSpector risk score?

Executable scripts apply a **1.3× multiplier** to the base score, resulting in a 30% increase. For example, a base score of 40 becomes 52, while a base score of 50 becomes 65. The final result is hard-capped at 100 points maximum to maintain the valid score range.

### Where is the executable script multiplier implemented in the SkillSpector codebase?

The multiplier logic resides in [`src/skillspector/nodes/report.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/report.py) within the `_compute_risk_score` function, specifically at lines 92-95. This code checks the `has_executable_scripts` boolean flag passed from the state and applies `min(100, int(total_score * 1.3))` when the flag is true.

### Can the executable script multiplier push a skill into a different severity category?

Yes. Since SkillSpector maps specific score ranges to severity bands (e.g., MEDIUM vs. HIGH), a 30% increase can cross threshold boundaries. A base score of 40 (typically MEDIUM) becomes 52 after multiplication, which may elevate the classification to HIGH and change the recommendation from *CAUTION* to *DO_NOT_INSTALL* according to the severity-to-action mapping.

### Is there a maximum risk score limit when the executable script multiplier is applied?

Yes. The implementation explicitly clamps the final score to 100 points using `min(100, int(total_score * 1.3))`. This prevents the multiplier from producing scores beyond the defined 0-100 range, ensuring that even skills with very high base scores and executable scripts cap at 100 (CRITICAL).