# What Programming Languages Are Used in SkillSpector? A Deep Dive into NVIDIA's Dual-Language Architecture

> Discover the programming languages powering SkillSpector. NVIDIA's SkillSpector uses Python for its security engine and TypeScript for integrations.

- Repository: [NVIDIA Corporation/SkillSpector](https://github.com/NVIDIA/SkillSpector)
- Tags: deep-dive
- Published: 2026-06-23

---

**SkillSpector is built primarily in Python and TypeScript**, with Python powering the core security scanning engine and TypeScript providing the integration layer for external agents.

The NVIDIA/SkillSpector repository employs a dual-language architecture designed to separate heavy-duty security analysis from external tooling interfaces. While Python handles complex AST parsing, static analysis, and LLM orchestration, TypeScript bridges the gap between the scanner and agent frameworks like the Pi-coding-agent.

## Python: The Core Security Engine

The majority of SkillSpector's executable logic resides in Python modules under `src/skillspector/`. This language choice supports the computationally intensive operations required for security scanning, including static analysis and LLM-based risk evaluation.

### Key Python Modules

The Python codebase is organized into specialized modules that handle distinct aspects of the scanning pipeline:

- **[`src/skillspector/cli.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/cli.py)** – Implements the entry point for the `skillspector` command-line tool
- **[`src/skillspector/graph.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/graph.py)** – Orchestrates the two-stage scanning workflow (static analysis followed by optional LLM evaluation)
- **[`src/skillspector/llm_utils.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/llm_utils.py)** – Provides helper utilities for interacting with LLM providers

In [`src/skillspector/graph.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/graph.py), the `invoke()` method coordinates the complete scan workflow:

```python
from skillspector import graph

# Run a full scan (static + optional LLM analysis)

result = graph.invoke({
    "input_path": "/path/to/skill",
    "output_format": "json",    # terminal | json | markdown | sarif

    "use_llm": True,            # set False for static-only scans

})

print(f"Risk Score: {result['risk_score']}/100")
print(f"Severity: {result['risk_severity']}")
print(f"Recommendation: {result['risk_recommendation']}")

```

The Python layer handles all **static analysis**, **AST parsing**, and **model registry** operations, making it the primary language for the security-scanning functionality.

## TypeScript: The Agent Integration Layer

TypeScript appears exclusively in the `extensions/` directory, specifically within [`extensions/skillspector.ts`](https://github.com/NVIDIA/SkillSpector/blob/main/extensions/skillspector.ts). This module wraps the Python CLI to expose SkillSpector as a registered tool for the Pi-coding-agent.

The TypeScript extension registers a `skillspector_scan` command that resolves the CLI binary and constructs arguments:

```typescript
import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";

export default function (pi: ExtensionAPI) {
  pi.registerTool({
    name: "skillspector_scan",
    label: "SkillSpector Scan",
    description:
      "Scan agent skills, directories, zip files, URLs, or Git repos for security risks using the local SkillSpector CLI.",
    parameters: /* see scanSchema in the source */,
    async execute(_toolCallId, params, _signal, onUpdate, ctx) {
      const bin = findSkillSpectorBin();               // resolves the CLI binary
      const args = buildScanArgs(params, ctx.cwd);     // builds CLI args
      const result = await pi.exec(bin, args, { cwd: ctx.cwd });
      // ...process result, redact secrets, and return text...
    },
  });
}

```

This architecture allows external agents to invoke Python-based security scans without directly managing the Python environment or constructing CLI arguments manually.

## Configuration and Declarative Files

While Python and TypeScript contain the executable logic, several declarative formats support the project structure:

- **[`pyproject.toml`](https://github.com/NVIDIA/SkillSpector/blob/main/pyproject.toml)** – Defines Python packaging, dependencies, and build metadata
- **[`package.json`](https://github.com/NVIDIA/SkillSpector/blob/main/package.json)** – Holds Node-related metadata for the TypeScript extension
- **[`model_registry.yaml`](https://github.com/NVIDIA/SkillSpector/blob/main/model_registry.yaml)** – Configures model parameters and registry settings

These files describe packaging and configuration but do not contain executable program logic, distinguishing them from the primary programming languages used in SkillSpector.

## Summary

- **SkillSpector uses Python and TypeScript** as its primary programming languages
- **Python** (`src/skillspector/`) contains the core security engine, CLI, static analyzers, and LLM utilities
- **TypeScript** ([`extensions/skillspector.ts`](https://github.com/NVIDIA/SkillSpector/blob/main/extensions/skillspector.ts)) provides the Pi-coding-agent integration layer
- The **`graph.invoke()`** method in [`src/skillspector/graph.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/graph.py) serves as the main Python API entry point
- Declarative files like [`pyproject.toml`](https://github.com/NVIDIA/SkillSpector/blob/main/pyproject.toml) and [`package.json`](https://github.com/NVIDIA/SkillSpector/blob/main/package.json) manage dependencies but do not contain executable logic

## Frequently Asked Questions

### Is SkillSpector written only in Python?

No. While the core security scanning engine is implemented in Python, SkillSpector also uses TypeScript for its extension layer. The TypeScript code in [`extensions/skillspector.ts`](https://github.com/NVIDIA/SkillSpector/blob/main/extensions/skillspector.ts) enables integration with external agents like the Pi-coding-agent by registering the `skillspector_scan` command.

### Why does SkillSpector use TypeScript alongside Python?

The TypeScript component acts as a bridge between the Python CLI and external agent frameworks. It registers the `skillspector_scan` tool and handles CLI argument building through functions like `findSkillSpectorBin()` and `buildScanArgs()`, allowing agent systems to invoke security scans without direct Python dependency management.

### What is the main entry point for the SkillSpector CLI?

The primary entry point is [`src/skillspector/cli.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/cli.py), which implements the command-line interface. For programmatic access, developers should use the `graph.invoke()` method in [`src/skillspector/graph.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/graph.py) to run scans with configurable static and LLM-based analysis.

### Are there any other programming languages used in SkillSpector?

No other programming languages are used for executable logic. While declarative formats like YAML ([`model_registry.yaml`](https://github.com/NVIDIA/SkillSpector/blob/main/model_registry.yaml)), TOML ([`pyproject.toml`](https://github.com/NVIDIA/SkillSpector/blob/main/pyproject.toml)), and JSON ([`package.json`](https://github.com/NVIDIA/SkillSpector/blob/main/package.json)) are present for configuration and packaging, they do not contain executable code according to the source repository structure.