# SkillSpector Executable Scripts Multiplier: How the 1.3× Risk Boost Works in NVIDIA/SkillSpector

> Discover how SkillSpector's executable scripts add a 1.3x risk boost to your scores. Learn about the multiplier implemented in project report.py.

- Repository: [NVIDIA Corporation/SkillSpector](https://github.com/NVIDIA/SkillSpector)
- Tags: deep-dive
- Published: 2026-06-21

---

**SkillSpector applies a 1.3× multiplier (30% increase) to the risk score when a skill contains executable scripts, as implemented in [`src/skillspector/nodes/report.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/report.py).**

NVIDIA/SkillSpector evaluates skill security by aggregating finding severities and applying conditional modifiers. When a scanned skill includes executable scripts, the tool automatically boosts the calculated risk score using this specific multiplier to reflect the increased attack surface.

## How the 1.3× Multiplier Works in SkillSpector Scoring

The risk calculation begins by summing base points from detected findings. CRITICAL issues contribute 50 points, HIGH severity issues add 25 points, MEDIUM issues add 10 points, and LOW issues add 5 points.

After summing the base score, SkillSpector checks for the presence of executable scripts. If `has_executable_scripts` evaluates to `True`, the framework applies a **1.3× multiplier** to the raw score before final risk band mapping.

### Base Score Calculation

- CRITICAL: +50 points
- HIGH: +25 points
- MEDIUM: +10 points
- LOW: +5 points

### Multiplier Application

The multiplier is applied as an integer multiplication: `int(score * 1.3)`. This calculation occurs immediately after base point aggregation and before the final score is capped at 100.

## Implementation Details in [`src/skillspector/nodes/report.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/report.py)

The core logic resides in the `_compute_risk_score` function within [`src/skillspector/nodes/report.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/report.py). The implementation checks the `has_executable_scripts` boolean flag and conditionally adjusts the score:

```python

# src/skillspector/nodes/report.py – risk calculation

if has_executable_scripts:
    score = int(score * 1.3)   # ← 1.3× multiplier for executable scripts

```

This operation occurs after summing the base points from findings and before mapping the final score to risk bands (such as "DO_NOT_INSTALL").

## Practical Example: Computing Risk Scores with Executable Scripts

The following example demonstrates how `_compute_risk_score` processes two HIGH severity findings (25 + 25 = 50 base points) with the executable scripts multiplier enabled:

```python
from skillspector.models import Finding
from skillspector.nodes.report import _compute_risk_score

# Example findings: two HIGH severity issues (25 + 25 = 50)

findings = [
    Finding(rule_id="E2", severity="HIGH", message="issue 1", file="run.py",
            start_line=1, end_line=2, confidence=0.9),
    Finding(rule_id="PE3", severity="HIGH", message="issue 2", file="run.py",
            start_line=3, end_line=4, confidence=0.9),
]

# Skill has an executable script → multiplier applied

score, severity, recommendation = _compute_risk_score(findings, has_executable_scripts=True)

print(score)          # → 65 (50 × 1.3)

print(severity)       # → "HIGH"

print(recommendation) # → "DO_NOT_INSTALL"

```

Without executable scripts, the same findings yield a lower score:

```python
score, severity, recommendation = _compute_risk_score(findings, has_executable_scripts=False)
print(score)  # → 50

```

## Unit Test Verification

The multiplier behavior is validated in [`tests/nodes/test_report.py`](https://github.com/NVIDIA/SkillSpector/blob/main/tests/nodes/test_report.py) by the test case `test_report_executable_scripts_multiplier`. This test confirms that a raw score of 50 becomes 65 when the executable script flag is set, ensuring the 1.3× calculation functions correctly across code updates.

## Summary

- SkillSpector applies a **1.3× multiplier** (30% boost) to risk scores when skills contain executable scripts.
- The calculation is implemented in [`src/skillspector/nodes/report.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/report.py) within the `_compute_risk_score` function.
- Base scoring awards 50 points for CRITICAL, 25 for HIGH, 10 for MEDIUM, and 5 for LOW findings.
- The multiplier is applied as `int(score * 1.3)` after base point aggregation and before risk band mapping.
- Unit tests in [`tests/nodes/test_report.py`](https://github.com/NVIDIA/SkillSpector/blob/main/tests/nodes/test_report.py) verify the multiplier logic remains consistent.

## Frequently Asked Questions

### What is the exact multiplier value for executable scripts in SkillSpector?

SkillSpector uses a **1.3× multiplier**, which increases the base risk score by 30%. This is implemented as integer multiplication: `int(score * 1.3)`.

### Where is the executable scripts multiplier implemented in the NVIDIA/SkillSpector codebase?

The multiplier logic is located in [`src/skillspector/nodes/report.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/report.py) inside the `_compute_risk_score` function. The code checks the `has_executable_scripts` parameter and applies the boost when true.

### How does the 1.3× multiplier affect the final risk band?

The multiplier is applied before risk band mapping. A boosted score may push the skill into a higher severity category (e.g., from "MEDIUM" to "HIGH"), triggering stricter recommendations such as "DO_NOT_INSTALL".

### Is the executable scripts multiplier applied before or after the base score calculation?

The multiplier is applied **after** summing base points from findings (CRITICAL, HIGH, MEDIUM, LOW) but **before** the final risk band determination and the 100-point cap.