SkillSpector Executable Scripts Multiplier: How the 1.3× Risk Boost Works in NVIDIA/SkillSpector

SkillSpector applies a 1.3× multiplier (30% increase) to the risk score when a skill contains executable scripts, as implemented in src/skillspector/nodes/report.py.

NVIDIA/SkillSpector evaluates skill security by aggregating finding severities and applying conditional modifiers. When a scanned skill includes executable scripts, the tool automatically boosts the calculated risk score using this specific multiplier to reflect the increased attack surface.

How the 1.3× Multiplier Works in SkillSpector Scoring

The risk calculation begins by summing base points from detected findings. CRITICAL issues contribute 50 points, HIGH severity issues add 25 points, MEDIUM issues add 10 points, and LOW issues add 5 points.

After summing the base score, SkillSpector checks for the presence of executable scripts. If has_executable_scripts evaluates to True, the framework applies a 1.3× multiplier to the raw score before final risk band mapping.

Base Score Calculation

• CRITICAL: +50 points
• HIGH: +25 points
• MEDIUM: +10 points
• LOW: +5 points

Multiplier Application

The multiplier is applied as an integer multiplication: int(score * 1.3). This calculation occurs immediately after base point aggregation and before the final score is capped at 100.

Implementation Details in src/skillspector/nodes/report.py

The core logic resides in the _compute_risk_score function within src/skillspector/nodes/report.py. The implementation checks the has_executable_scripts boolean flag and conditionally adjusts the score:

# src/skillspector/nodes/report.py – risk calculation

if has_executable_scripts:
    score = int(score * 1.3)   # ← 1.3× multiplier for executable scripts

This operation occurs after summing the base points from findings and before mapping the final score to risk bands (such as "DO_NOT_INSTALL").

Practical Example: Computing Risk Scores with Executable Scripts

The following example demonstrates how _compute_risk_score processes two HIGH severity findings (25 + 25 = 50 base points) with the executable scripts multiplier enabled:

from skillspector.models import Finding
from skillspector.nodes.report import _compute_risk_score

# Example findings: two HIGH severity issues (25 + 25 = 50)

findings = [
    Finding(rule_id="E2", severity="HIGH", message="issue 1", file="run.py",
            start_line=1, end_line=2, confidence=0.9),
    Finding(rule_id="PE3", severity="HIGH", message="issue 2", file="run.py",
            start_line=3, end_line=4, confidence=0.9),
]

# Skill has an executable script → multiplier applied

score, severity, recommendation = _compute_risk_score(findings, has_executable_scripts=True)

print(score)          # → 65 (50 × 1.3)

print(severity)       # → "HIGH"

print(recommendation) # → "DO_NOT_INSTALL"

Without executable scripts, the same findings yield a lower score:

score, severity, recommendation = _compute_risk_score(findings, has_executable_scripts=False)
print(score)  # → 50

Unit Test Verification

The multiplier behavior is validated in tests/nodes/test_report.py by the test case test_report_executable_scripts_multiplier. This test confirms that a raw score of 50 becomes 65 when the executable script flag is set, ensuring the 1.3× calculation functions correctly across code updates.

Summary

• SkillSpector applies a 1.3× multiplier (30% boost) to risk scores when skills contain executable scripts.
• The calculation is implemented in src/skillspector/nodes/report.py within the _compute_risk_score function.
• Base scoring awards 50 points for CRITICAL, 25 for HIGH, 10 for MEDIUM, and 5 for LOW findings.
• The multiplier is applied as int(score * 1.3) after base point aggregation and before risk band mapping.
• Unit tests in tests/nodes/test_report.py verify the multiplier logic remains consistent.

Frequently Asked Questions

What is the exact multiplier value for executable scripts in SkillSpector?

SkillSpector uses a 1.3× multiplier, which increases the base risk score by 30%. This is implemented as integer multiplication: int(score * 1.3).

Where is the executable scripts multiplier implemented in the NVIDIA/SkillSpector codebase?

The multiplier logic is located in src/skillspector/nodes/report.py inside the _compute_risk_score function. The code checks the has_executable_scripts parameter and applies the boost when true.

How does the 1.3× multiplier affect the final risk band?

The multiplier is applied before risk band mapping. A boosted score may push the skill into a higher severity category (e.g., from "MEDIUM" to "HIGH"), triggering stricter recommendations such as "DO_NOT_INSTALL".

Is the executable scripts multiplier applied before or after the base score calculation?

The multiplier is applied after summing base points from findings (CRITICAL, HIGH, MEDIUM, LOW) but before the final risk band determination and the 100-point cap.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}