What Programming Languages Are Used in SkillSpector? A Deep Dive into NVIDIA's Dual-Language Architecture

SkillSpector is built primarily in Python and TypeScript, with Python powering the core security scanning engine and TypeScript providing the integration layer for external agents.

The NVIDIA/SkillSpector repository employs a dual-language architecture designed to separate heavy-duty security analysis from external tooling interfaces. While Python handles complex AST parsing, static analysis, and LLM orchestration, TypeScript bridges the gap between the scanner and agent frameworks like the Pi-coding-agent.

Python: The Core Security Engine

The majority of SkillSpector's executable logic resides in Python modules under src/skillspector/. This language choice supports the computationally intensive operations required for security scanning, including static analysis and LLM-based risk evaluation.

Key Python Modules

The Python codebase is organized into specialized modules that handle distinct aspects of the scanning pipeline:

• src/skillspector/cli.py – Implements the entry point for the skillspector command-line tool
• src/skillspector/graph.py – Orchestrates the two-stage scanning workflow (static analysis followed by optional LLM evaluation)
• src/skillspector/llm_utils.py – Provides helper utilities for interacting with LLM providers

In src/skillspector/graph.py, the invoke() method coordinates the complete scan workflow:

from skillspector import graph

# Run a full scan (static + optional LLM analysis)

result = graph.invoke({
    "input_path": "/path/to/skill",
    "output_format": "json",    # terminal | json | markdown | sarif

    "use_llm": True,            # set False for static-only scans

})

print(f"Risk Score: {result['risk_score']}/100")
print(f"Severity: {result['risk_severity']}")
print(f"Recommendation: {result['risk_recommendation']}")

The Python layer handles all static analysis, AST parsing, and model registry operations, making it the primary language for the security-scanning functionality.

TypeScript: The Agent Integration Layer

TypeScript appears exclusively in the extensions/ directory, specifically within extensions/skillspector.ts. This module wraps the Python CLI to expose SkillSpector as a registered tool for the Pi-coding-agent.

The TypeScript extension registers a skillspector_scan command that resolves the CLI binary and constructs arguments:

import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";

export default function (pi: ExtensionAPI) {
  pi.registerTool({
    name: "skillspector_scan",
    label: "SkillSpector Scan",
    description:
      "Scan agent skills, directories, zip files, URLs, or Git repos for security risks using the local SkillSpector CLI.",
    parameters: /* see scanSchema in the source */,
    async execute(_toolCallId, params, _signal, onUpdate, ctx) {
      const bin = findSkillSpectorBin();               // resolves the CLI binary
      const args = buildScanArgs(params, ctx.cwd);     // builds CLI args
      const result = await pi.exec(bin, args, { cwd: ctx.cwd });
      // ...process result, redact secrets, and return text...
    },
  });
}

This architecture allows external agents to invoke Python-based security scans without directly managing the Python environment or constructing CLI arguments manually.

Configuration and Declarative Files

While Python and TypeScript contain the executable logic, several declarative formats support the project structure:

• pyproject.toml – Defines Python packaging, dependencies, and build metadata
• package.json – Holds Node-related metadata for the TypeScript extension
• model_registry.yaml – Configures model parameters and registry settings

These files describe packaging and configuration but do not contain executable program logic, distinguishing them from the primary programming languages used in SkillSpector.

Summary

• SkillSpector uses Python and TypeScript as its primary programming languages
• Python (src/skillspector/) contains the core security engine, CLI, static analyzers, and LLM utilities
• TypeScript (extensions/skillspector.ts) provides the Pi-coding-agent integration layer
• The graph.invoke() method in src/skillspector/graph.py serves as the main Python API entry point
• Declarative files like pyproject.toml and package.json manage dependencies but do not contain executable logic

Frequently Asked Questions

Is SkillSpector written only in Python?

No. While the core security scanning engine is implemented in Python, SkillSpector also uses TypeScript for its extension layer. The TypeScript code in extensions/skillspector.ts enables integration with external agents like the Pi-coding-agent by registering the skillspector_scan command.

Why does SkillSpector use TypeScript alongside Python?

The TypeScript component acts as a bridge between the Python CLI and external agent frameworks. It registers the skillspector_scan tool and handles CLI argument building through functions like findSkillSpectorBin() and buildScanArgs(), allowing agent systems to invoke security scans without direct Python dependency management.

What is the main entry point for the SkillSpector CLI?

The primary entry point is src/skillspector/cli.py, which implements the command-line interface. For programmatic access, developers should use the graph.invoke() method in src/skillspector/graph.py to run scans with configurable static and LLM-based analysis.

Are there any other programming languages used in SkillSpector?

No other programming languages are used for executable logic. While declarative formats like YAML (model_registry.yaml), TOML (pyproject.toml), and JSON (package.json) are present for configuration and packaging, they do not contain executable code according to the source repository structure.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}