feat: offline security inspection plugin with runtime, drift, and pol… - #498
Open
KodeCharya wants to merge 4 commits into
Open
feat: offline security inspection plugin with runtime, drift, and pol…#498KodeCharya wants to merge 4 commits into
KodeCharya wants to merge 4 commits into
Conversation
…icy enforcement Add 100% offline, deterministic security inspection plugin for NVIDIA Skill Inspector. Core (9 modules, air-gapped, no cloud/LLM/telemetry): - Dependency graph: networkx DiGraph + AST/import + manifest, Cytoscape (vendored offline) + cycle detection - Permissions: declared vs observed (filesystem/network/subprocess/env/mcp) + least-privilege - Provenance: SHA-256 + author/origin/version history + SQLite (~/.skill-inspector/) - Secrets: 16 regex + Shannon entropy >=4.2 + logging detection (SEC-*) - Diff: git plumbing + difflib fallback + escalation detection - SBOM: CycloneDX 1.5 + pURLs + hashes per-skill + aggregate - Scorecard: severity×category weighted 0–100 + grade A–F - Privacy: PII/Credentials/Financial/... + read/write/transmit flow - Reporting: FastAPI + Jinja2 on 127.0.0.1 only, vendored cytoscape.min.js Intelligence layer (new): - Runtime Behavior Monitor: isolated tempfile sandbox, audit-hook/monkey-patch collectors for filesystem/network/processes/env/executables/package/MCP/DNS/outbound - SecurityEvent normalized model (source/category/action/subject/target/capability) → EventGraph - Drift Analyzer: declared vs static vs runtime → MATCH/UNDER_DECLARED/OVER_DECLARED - Correlation Engine: credential→file→subprocess→network attack paths (CRED_EXFIL, DATA_EXFIL) - Policy-as-Code: YAML allow/deny → PASS/WARN/BLOCK (policy check) - Regression Engine: security-diff old/ new/ → risk/grade delta + BLOCK decision Integration: - src/skillspector/security_inspection/* + src/skillspector/nodes/analyzers/offline_security_inspection.py (auto-discovered) - CLI: offline-scan --runtime, runtime-scan, policy, security-diff, security-report/server - pyproject: yara conditional for Windows, networkx/jinja2/fastapi/uvicorn, hatch templates/static - Tests: 44 passed (plugin/tests/test_security_plugin.py + test_comprehensive.py) - THIRD_PARTY_NOTICES.md for vendored cytoscape (offline, no CDN) Storage: SQLite + SBOM + reports under ~/.skill-inspector/, loopback only.
…ine plugin Signed-off-by: Kode Charya(Mukesh Choudhary) <[email protected]>
rng1995
requested changes
Sep 12, 2026
rng1995
left a comment
Collaborator
There was a problem hiding this comment.
[SkillSpector Review]
Changes requested at head a25967d93971e9173dea076faa438e4a1c34572c.
src/skillspector/security_inspection/runtime_monitor.py:163: the feature presented as an "isolated" runtime scan directlyexecs the first Python file from an untrusted skill in an ordinary same-user subprocess.run_isolatedalso starts it withos.environ.copy()(:193) and the skill directory as its working directory (:207). The audit hook records filesystem/process operations rather than denying them, and Python socket monkey-patches are not an OS security boundary. A scanned skill can read or modify host-accessible files, consume copied credentials, spawn commands, or bypass the network patch before the timeout terminates it. Do not execute untrusted skill code until this uses a real OS-level sandbox with a minimal allowlisted environment, read-only/isolated mounts, denied child processes and network, resource limits, and adversarial escape tests; otherwise remove the runtime-execution path and its isolation claims.- The current head also fails required
lint,test-unit, and DCO checks, plusdocker-smoke. Fix the reported Ruff violations, add the missing Signed-off-by trailers, and make the repository smoke scan complete successfully.
This is not merge-ready.
rng1995
reviewed
Sep 12, 2026
rng1995
left a comment
Collaborator
There was a problem hiding this comment.
[SkillSpector Review]
Scope clarification for head a25967d93971e9173dea076faa438e4a1c34572c: the existing Changes Requested review remains in force, including its unsafe runtime-execution blocker and failing required checks. That review was blocker-driven, not an exhaustive security or behavioral assessment.
This PR spans 91 files and 10,805 additions across runtime execution, CLI/server/storage/policy code, duplicated plugin/ and src/ implementations, vendored JavaScript, dependency changes, and unrelated batch-scan edits. Please split the runtime path and unrelated refactors into focused PRs, then request fresh security and functional review for each independently reviewable unit. Current CI is still red for lint, unit tests, DCO, and docker-smoke.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add 100% offline, deterministic security inspection plugin for NVIDIA Skill Inspector.
Core (9 modules, air-gapped, no cloud/LLM/telemetry):
Intelligence layer (new):
Integration:
Storage: SQLite + SBOM + reports under ~/.skill-inspector/, loopback only.