SkillSpector v2.11.2

Released: 2026-09-10

Summary

SkillSpector 2.11.2 fixes fatal reference-accounting errors and several false static-parser limits triggered by ordinary documentation. This patch also preserves incomplete-analysis reporting when a runtime-selected executable prevents exact command reconstruction.

Highlights

Complete reference accounting when Markdown labels and destinations identify the same artifact, or when several referenced artifacts appear on one source line.
Avoid false parser limits for simple runtime parameters, inline skill invocations, PowerShell member access, and long quoted prose.
Keep runtime-selected printf and wrapper paths marked as partially inspected.

Added

None.

Changed

Record reference-coverage completion once per source line.

Fixed

Deduplicate reference-coverage records for the same source file, line, and target, preventing fatal unaccounted_work errors from duplicate Markdown references.
Account for distinct reference targets on the same source line without creating conflicting completion records.
Distinguish simple runtime parameters from command substitutions and complex parameter expansions in bounded shell reconstruction, including inline $ARGUMENTS documentation (#464).
Count unquoted characters separately from already-consumed quoted spans so long quoted prose does not cause a false command-word span limit.
Preserve partial coverage when runtime parameters select a printf, command, builtin, or env executable path; a recognized basename alone cannot establish which executable will run.

Security

Fixed security findings.

Breaking Changes and Migration

None. No new configuration is required.

Deprecations

None.

Validation

Validated locally with Python 3.12 and uv 0.10.10:

uv lock --check — passed; third-party dependency versions are unchanged.
uv run --no-sync make test-ci — 4,013 passed, 14 skipped, 38 deselected, and 4 expected failures.
uv run --no-sync make lint and uv run --no-sync make format-check — passed.
Built wheel and source distributions; twine check passed for both artifacts.
skillspector --version — reported SkillSpector v2.11.2.
The GitHub release helper dry run resolved v2.11.2 and the matching versioned release notes.
Docker image build and repository smoke tests passed on Linux/arm64, including the local safe fixture and public GitHub repository scans.
git diff --check — passed.

Known Limitations

Full LLM analysis and downstream CI behavior require validation in the deployment that uses the release.

References

SkillSpector v2.11.1

Released: 2026-09-07

Summary

SkillSpector 2.11.1 raises the default aggregate scan deadline from 60 seconds to 600 seconds and makes it configurable, preventing larger valid scans from timing out under the previous one-minute workflow budget. This patch release also includes security-analysis correctness fixes merged since 2.11.0.

Highlights

Give direct, recursive, transitive, and multi-skill scans a 600-second aggregate workflow deadline by default.
Allow operators to set a positive finite deadline with SKILLSPECTOR_MAX_WORKFLOW_SECONDS while retaining the safe default for invalid values.
Preserve security finding classifications during scan-view and report deduplication, and strengthen detection of concealed instructions.

Added

Add SKILLSPECTOR_MAX_WORKFLOW_SECONDS as an optional environment setting for the aggregate workflow deadline.

Changed

Increase the default end-to-end workflow and transitive traversal deadline from 60 seconds to 600 seconds.
Apply the configured deadline consistently across direct CLI, recursive, transitive, and multi-skill analysis paths.
Enforce SKILLSPECTOR_MAX_LLM_CONCURRENCY across all concurrently running LLM analyzers instead of separately within each analyzer.

Fixed

Prevent premature workflow termination for scans that legitimately need more than one minute.
Parse whitespace-separated allowed-tools declarations without producing least-privilege false positives.
Normalize bounded concealed-instruction text and fail closed when inter-character obfuscation prevents complete interpretation.
Keep safe and unsafe findings distinct when they share a rule fingerprint so deduplication cannot discard or misclassify security evidence.

Security

Retain classification and bounded evidence in finding identity across raw, normalized, continuity, report, JSON, and SARIF projections.
Detect security-relevant instructions concealed with default-ignorable characters or bounded inter-character separators while preserving benign multilingual, punctuation, URL, email, table, and code controls.
Bound total in-flight LLM requests across analyzers sharing an event loop and configured limit, improving behavior with rate-limited providers.

Breaking Changes and Migration

None. Existing users automatically receive the 600-second default.
Deployments that require a different aggregate deadline can set SKILLSPECTOR_MAX_WORKFLOW_SECONDS to a positive finite number of seconds. Invalid, zero, negative, infinite, and NaN values retain the 600-second default.

Deprecations

None.

Validation

uv lock --check — passed.
uv run --no-sync pytest -q — 3,985 passed, 14 skipped, 38 deselected, and 4 expected failures.
uv run --no-sync ruff check src/ tests/ scripts/ — passed.
uv run --no-sync ruff format --check src/ tests/ scripts/ — 201 files already formatted.
Built wheel and source distributions; twine check passed for both artifacts.
skillspector --version — reported SkillSpector v2.11.1.
The GitHub release helper dry run resolved tag v2.11.1 and the matching versioned release notes.
git diff --check — passed.

Known Limitations

The deadline is an aggregate ceiling, not a per-analyzer allowance. All work in a direct or recursive scan shares the same configured budget.
Changing SKILLSPECTOR_MAX_WORKFLOW_SECONDS requires starting a new SkillSpector process because the setting is resolved when the workflow state module is imported.
Provider-specific request timeouts and deterministic byte, artifact, and analyzer ceilings remain independently enforced.

References

SkillSpector v2.11.0

Released: 2026-08-28

Summary

SkillSpector 2.11.0 expands supply-chain coverage to installed npm dependency versions, adds bounded analysis of bundled lifecycle hooks and project permission grants, and introduces optional LLM sampling controls. It also improves provider guidance and fallback routing, supports secure file traversal in restricted Linux environments, and removes two reported MP3/P6 false positives without weakening directive detection.

Highlights

Resolve exact direct and transitive npm versions from package-lock.json and npm-shrinkwrap.json before vulnerability analysis.
Add BH1–BH3 findings for bundled lifecycle hooks, directly proven remote transfer of sensitive content, and broad or ignored project permission modes.
Add SKILLSPECTOR_TEMPERATURE and SKILLSPECTOR_SEED controls while preserving provider defaults when they are unset.
Avoid MP3 and P6 findings for the reported nominal state-coverage and CSS print-rule descriptions while retaining actionable reset and disclosure directives.

Added

Parse npm lockfile versions 1, 2, and 3 under the existing dependency-analysis resource bounds, including nested installs and multiple installed versions of the same package.
Analyze hooks/hooks.json, .claude/settings.json, and .claude/settings.local.json for bundled hook execution (BH1), directly proven remote transfer of sensitive event or file content (BH2), and broad permission surfaces (BH3).
Add optional SKILLSPECTOR_TEMPERATURE validation for hosted providers and optional SKILLSPECTOR_SEED forwarding for OpenAI-compatible and Azure OpenAI endpoints.

Changed

Expand skillspector scan --help to list all supported hosted, local, compatible, and CLI-backed LLM providers with their authentication paths.
Resolve configured model defaults from the provider that will actually build the chat model when OpenAI credentials satisfy the fallback path.

Fixed

Traverse intermediate path components with O_PATH where available so restricted Linux sandboxes do not require read access to every ancestor; final-file and no-symlink protections remain unchanged.
Suppress only the bounded nominal grammar reported for initial/reset state and descendant/compound/print rules are NOT evaluated, including the reported line wrapping.
Preserve MP3 and P6 detection for imperatives, agent-scoped instructions, anaphoric follow-ups, mixed benign/malicious content, and unrecognized surrounding grammar.

Security

Scan exact npm lockfile versions, including transitive and non-hoisted copies, instead of relying only on manifest ranges.
Report conditional bundled hook reach, closed evidence of sensitive remote transfer, and declared project permission surfaces without executing bundled content.
Preserve descriptor-relative, no-follow file opening while allowing safe traversal through search-only ancestor permissions on supported Linux systems.
Keep the new nominal-phrase exclusions match-local and fail closed when directive framing or referential continuation is present.

Breaking Changes and Migration

No CLI command, option, provider, or report field was removed.
Existing scans may report new BH1–BH3 findings for supported bundled hook and settings files. Review those findings and use the existing baseline mechanism only after validating the declared execution or permission surface.
SKILLSPECTOR_TEMPERATURE accepts values from 0 through 1, and SKILLSPECTOR_SEED accepts integers. Leave either variable unset or blank to preserve provider defaults.

Deprecations

None.

Validation

uv lock --check — passed.
.venv/bin/pytest -q tests/unit/test_create_github_release.py tests/unit/test_github_release_workflow.py tests/unit/test_wheel_contents.py — 11 passed.
Targeted regressions for bundled execution surfaces, npm lockfiles, provider routing and sampling, secure input traversal, CLI help, reporting, and MP3/P6 contextual handling — 1,070 passed and 10 skipped.
.venv/bin/ruff check src/ tests/ scripts/ — passed.
.venv/bin/ruff format --check src/ tests/ scripts/ — 199 files already formatted.
Built skillspector-2.11.0-py3-none-any.whl and skillspector-2.11.0.tar.gz; twine check passed for both distributions.
skillspector --version — reported SkillSpector v2.11.0.
The GitHub release helper dry run resolved tag v2.11.0 and the matching versioned release notes.
git diff --check — passed.

Known Limitations

npm lockfile resolution covers package-lock.json and npm-shrinkwrap.json; Yarn and pnpm lockfiles are not included in this release.
Bundled execution-surface analysis is limited to the supported exact configuration paths and does not execute hooks. Findings distinguish declarations that require conditional activation from permission modes ignored by the supported surface.
Seed support is provider- and model-dependent and is forwarded only to OpenAI-compatible and Azure OpenAI endpoints.
The MP3/P6 nominal exclusions intentionally recognize only the bounded reported grammar; other ambiguous prose remains fail closed for manual review.

References

SkillSpector v2.10.0

Released: 2026-08-26

Summary

SkillSpector 2.10.0 expands security coverage across concealed artifacts, referenced skills, structured skill bundles, and external model selection. It also makes incomplete analysis harder to mistake for a clean result, adds localized LLM finding text, and exposes the highest reported issue severity for downstream policy gates.

Highlights

Inspect hidden files and ZIP-compatible nested artifacts under cumulative safety bounds, with HIGH SC9 findings for concealed executables and provenance-preserving virtual paths.
Add opt-in transitive reference scanning with bounded traversal, source provenance, shared budgets, and fail-closed completeness reporting.
Recognize AISOP/AISP structured skill bundles and render report-only workflow summaries without affecting risk scores.
Add EA5 detection for external model or provider selection, including silent coding-CLI account switches and top-level model pins.
Add SKILLSPECTOR_OUTPUT_LANGUAGE for human-readable LLM finding text and risk_assessment.max_issue_severity for machine-readable policy gates.

Added

Add bounded local inspection of hidden and nested ZIP, DOCX, XLSX, and PPTX content without extracting or executing members.
Add opt-in transitive scanning of supported skill references with --transitive, plus --transitive-depth, --transitive-allow-prefix, and --transitive-deny-prefix controls.
Add structured skill summaries for valid AISOP/AISP bundles across terminal, Markdown, JSON, and SARIF output.
Add dynamic analyzer discovery and validate risk-score inputs against the registered analyzer set.
Add EA5 static findings for actionable external model or provider selection.
Add configurable output-language instructions for discovery analyzers, the meta-analyzer, and MCP tool-poisoning analysis.
Add risk_assessment.max_issue_severity, with NONE when no active issue is reported.

Changed

Move langgraph-cli[inmem] from the base installation to the langgraph-dev optional extra; the dev extra continues to include it.
Update the NVIDIA Build default model to a currently served model and declare accurate limits for GLM-5.2.
Tailor LP1 least-privilege remediation to the scanned manifest type.
Automatically update eligible pull-request branches after changes land on main.

Fixed

Mark requested LLM analysis as degraded when any call fails or the configured provider is unavailable, flooring an otherwise SAFE recommendation to CAUTION.
Report and baseline only the active findings that actually drove the risk score.
Normalize serialized multi-skill risk scores before computing aggregate exit codes, with malformed values safely falling back to zero.
Preserve eligible findings from SKILL.md instead of dropping them as code examples.
Parse package.json as JSON for supply-chain analysis and route fatal CLI diagnostics to stderr.
Detect whitespace-tolerant environment harvesting and all supported os.environ read forms.
Reduce false positives across inactive Git hook samples, license boilerplate, wildcard tool grants, OAuth credential terminology, reference directories, and non-text artifact content.
Require an operation tied to a keyring or keychain noun before reporting PE3 in Markdown and text prose, while preserving actionable credential-store findings.
Preserve the original custom CLI-provider call contract for ordinary scans while forwarding explicit deadlines to providers used by bounded scan paths.

Security

Strengthen cumulative resource bounds, inspection-ledger completeness, finding provenance, Unicode normalization, and fail-closed behavior across scan paths.
Keep hidden and nested artifact content local to deterministic analysis and exclude it from LLM prompts.
Preserve deterministic security findings through filtering, suppression, recursive, transitive, MCP, and report-rendering paths.
Surface partial provider execution and traversal truncation so incomplete deep scans cannot silently appear clean.

Breaking Changes and Migration

No existing CLI command, option, or report field was removed.
LangGraph Studio users who install only the base package should install skillspector[langgraph-dev]; make install-dev and the dev extra continue to include this tooling.
Custom CLI providers keep the original complete(prompt, *, model, max_output_tokens) contract for ordinary scans. Providers used with new deadline-bounded paths may additionally accept timeout as an optional keyword.

Deprecations

None.

Validation

uv lock --check — passed.
.venv/bin/pytest -q tests/unit/test_llm_utils.py tests/unit/test_create_github_release.py tests/unit/test_github_release_workflow.py tests/unit/test_wheel_contents.py — 54 passed.
.venv/bin/pytest -m 'not integration and not provider' --cov=src/skillspector --cov-report=term --cov-report=xml tests/ — 2,937 passed, 13 skipped, 38 deselected, and 4 expected failures.
.venv/bin/ruff check src/ tests/ scripts/ — passed.
.venv/bin/ruff format --check src/ tests/ scripts/ — 196 files already formatted.
Built skillspector-2.10.0-py3-none-any.whl and skillspector-2.10.0.tar.gz; twine check passed for both distributions.
skillspector --version — reported SkillSpector v2.10.0.
The GitHub release helper dry run resolved tag v2.10.0 and the matching versioned release notes.
git diff --check — passed.

Known Limitations

Transitive scanning remains opt-in and is limited to source types supported by the secure input handler; it is not a general-purpose web crawler and is not enabled for MCP scans.
Nested inspection is limited to ZIP-compatible containers, enforces fixed cumulative bounds, and does not render, install, or execute nested content.
SKILLSPECTOR_OUTPUT_LANGUAGE affects human-readable LLM-generated finding text only; deterministic findings and machine-readable schema values remain unchanged.
Legacy custom CLI providers that do not accept timeout remain compatible with ordinary scans but cannot participate in a new path that requires an explicit provider deadline until they add that optional keyword.

References

SkillSpector v2.9.6

Released: 2026-08-18

Summary

SkillSpector 2.9.6 improves PE3 credential-access accuracy for OAuth documentation. It now distinguishes compound-noun uses of access token and access tokens from instructions that access credentials, removing HIGH-severity false positives without weakening detection of actionable credential access.

Highlights

Stop flagging ordinary OAuth glossary entries, return-value descriptions, revocation behavior, storage guidance, and supported-token tables as credential-access findings.
Preserve PE3 findings for imperative and modal access instructions, sensitive credential sources, and read, copy, send, post, leak, and exfiltration actions.

Added

Add benign and adversarial regression coverage for OAuth terminology in Markdown tables, headings, later clauses, URL navigation, action inflections, and HTTP POST token flows.

Changed

Classify noun-shaped access token terminology in documentation using bounded grammatical context instead of a narrow OAuth lifecycle allowlist.

Fixed

Prevent ordinary OAuth terminology in documentation from producing HIGH-severity PE3 findings while retaining findings for credential-access actions embedded in or adjacent to benign prose.

Security

Keep the OAuth documentation exception fail-closed when bounded context contains credential actions or sensitive sources.

Breaking Changes and Migration

None.

Deprecations

None.

Validation

uv run pytest -q tests/unit/test_patterns.py tests/nodes/analyzers/test_binary_and_pe3_filtering.py tests/nodes/analyzers/test_static_runner_filtering.py — 204 passed.
uv run pytest -q --ignore=tests/unit/test_input_handler.py --ignore=tests/unit/test_input_handler_ssrf.py — 2,158 passed, 13 skipped, and 4 expected failures.
uv run ruff check src/ tests/ — passed.
uv run ruff format --check src/ tests/ — passed.

Known Limitations

The documentation exception is intentionally limited to Markdown and text files under recognized documentation paths; other file types and locations continue to use the stricter PE3 rule.

References

GitHub PR #392

SkillSpector v2.9.5

Released: 2026-08-14

Summary

SkillSpector 2.9.5 expands provider support, adds opt-in author-shipped baselines, and strengthens static detection for insecure deserialization. It also improves analyzer accuracy and compatibility across safety-pattern, MCP dependency, and YARA scanning paths.

Highlights

Add Ollama, Azure OpenAI, and generic OpenAI-compatible providers.
Add static detection coverage for insecure deserialization patterns.
Improve scan accuracy with opt-in shipped baselines, lower false positives, and more precise YARA source locations.

Added

Add Ollama support for local OpenAI-compatible inference, Azure OpenAI deployment routing, and a configurable provider for other OpenAI-compatible endpoints.
Add opt-in discovery of a top-level .skillspector-baseline.yaml while keeping explicitly supplied baselines authoritative.
Add analyzer coverage for insecure deserialization patterns represented by AST10, TT6, and DS1–DS4 findings.

Changed

Use byte offsets when mapping YARA matches back to source lines so non-ASCII content is reported accurately.
Scope the destructive-autonomy YARA post-filter to SkillSpector's built-in rule namespace and preserve deterministic built-in rule precedence.

Fixed

Reduce false positives when safety-sensitive language explicitly negates unsafe behavior.
Bound the optional MCP dependency to the supported major version.

Security

Expand static analysis for insecure deserialization behavior and prevent custom YARA rules that reuse a built-in rule name from being incorrectly post-filtered.

Breaking Changes and Migration

None.

Deprecations

None.

Validation

Targeted and regression suites for provider selection, shipped baselines, deserialization analysis, safety-pattern controls, MCP packaging, and YARA analysis passed for the prepared imports.
Ruff lint, Ruff formatting checks, and git diff --check passed for every prepared import.
Required CI lint, unit, integration, Docker smoke, and Sonar checks passed for all seven imported changes.

Known Limitations

Ollama support requires a reachable local Ollama service; Azure OpenAI and generic OpenAI-compatible providers require their provider-specific endpoint and credential configuration.

References

SkillSpector v2.9.4

Released: 2026-08-12

Summary

This patch strengthens SkillSpector’s safe handling of MCP requests and untrusted skill content, while adding broader prompt-injection and supply-chain detection coverage. It also improves permission guidance, ships a companion Skill Inspector guide, and refreshes project documentation.

Highlights

HTTP-exposed MCP servers now reject caller-controlled local scan targets and local YARA-rule directories while preserving local scanning for trusted stdio use.
Detect whitespace-padding prompt-injection attempts and shipped Python bytecode, with improved minimum risk scoring for high-impact findings.

Added

Add detection for whitespace padding used to hide prompt-injection instructions.
Add a HIGH SC8 finding when a skill ships Python bytecode or __pycache__ content.
Add the Skill Inspector companion skill guide.

Changed

Treat allowed-tools as valid least-privilege permission guidance in remediations and documentation.
Add an OpenSSF Scorecard badge to the project documentation.

Fixed

Reject local filesystem scan targets and local YARA-rule directories for HTTP MCP transport, preventing remote callers from selecting scanner-host paths.
Reject symlinked skill content during discovery and disable Git symlink materialization when cloning input repositories.
Ensure high-impact findings receive an appropriate minimum risk score.

Security

Harden HTTP MCP transport against local-path access and strengthen skill-content handling against symlink traversal.

Breaking Changes and Migration

HTTP MCP clients can no longer scan local filesystem paths or provide local YARA-rule directories. Use a remote repository or URL for HTTP requests; use trusted stdio transport for local scans.

Deprecations

None.

Validation

Internal GitLab merge-request CI passed lint, unit, integration, Docker smoke, and Sonar analysis for the six imported public changes.
uv run --locked --extra dev pytest -q tests/unit/test_mcp_server.py — 26 passed for the HTTP MCP transport remediation.

Known Limitations

HTTP MCP transport intentionally rejects local filesystem inputs; this is a security boundary rather than an unsupported scanner capability.

References

CHANGELOG.md

SkillSpector v2.9.3

Released: 2026-08-11

Summary

This patch makes malformed structured LLM responses non-fatal during analysis. Affected analysis work is now recorded as skipped so reports clearly show degraded, incomplete results while preserving the remaining analysis output.

Highlights

Improve resilience to malformed structured responses from LLM-backed analyzers without masking the affected analysis outcome.

Added

None.

Changed

Analysis ledger and analyzer status handling consistently represent malformed structured-response batches as skipped and degraded rather than failed.

Fixed

Preserve the input findings and incomplete-analysis provenance when a malformed structured response exhausts retry handling.

Security

None.

Breaking Changes and Migration

None.

Deprecations

None.

Validation

uv run --locked --extra dev pytest tests/nodes/test_llm_analyzer_base.py tests/nodes/test_meta_analyzer.py tests/nodes/test_finalize_inspection_ledger.py tests/test_inspection_ledger.py tests/test_mcp_tool_poisoning.py — passed.

Known Limitations

Malformed structured responses remain unavailable for analysis; this release surfaces their impact as incomplete rather than producing findings for the affected work.

References

CHANGELOG.md

SkillSpector v2.9.2

Released: 2026-08-10

Summary

This patch release makes structured LLM response handling more resilient to transient malformed payloads. It retries validation and structured-output parse failures with bounded backoff while retaining fail-closed batch isolation after the retry budget is exhausted.

Highlights

Structured LLM response failures now receive bounded retries before a batch is isolated.

Added

None.

Changed

Applied the structured-response retry policy centrally to semantic analyzers, the meta-analyzer, TP4, and gap-fill paths.

Fixed

Prevented transient malformed structured responses from immediately exhausting required LLM batches.

Security

None.

Breaking Changes and Migration

None.

Deprecations

None.

Validation

git diff --check release/2.9.1..origin/main — passed.
Automated CI — lint, unit, integration, and Docker smoke checks passed; Sonar analysis succeeded.

Known Limitations

Requests still fail closed after the bounded retry budget is exhausted.

References

CHANGELOG.md

SkillSpector v2.9.1

Released: 2026-08-10

Summary

This patch release improves resilience to transient LLM-provider connection failures during analysis. It uses bounded retries and records clearer batch-failure reasons when retries cannot recover.

Highlights

Adds bounded retries for transient LLM provider connection failures while preserving per-batch failure reporting.

Added

The inspection ledger distinguishes malformed structured LLM responses from exhausted connection retries.

Changed

Supported OpenAI and Anthropic clients use a common bounded native retry budget, while other providers receive the same bounded fallback retry schedule when applicable.

Fixed

Transient LLM connection failures no longer terminate a batch before the configured retry budget is exhausted.

Security

None.

Breaking Changes and Migration

None.

Deprecations

None.

Validation

uv run --locked --extra dev pytest tests/nodes/test_llm_analyzer_base.py tests/nodes/test_meta_analyzer.py — passed.
GitLab main pipeline 61992428 — passed.
git diff --check release/2.9.0..68c7a026d4b2d574b63019ceacd8fe8d7caa35db — passed.

Known Limitations

Retries are limited to transient LLM provider connection errors; other provider errors fail immediately.

References

CHANGELOG.md

Uh oh!

Releases: NVIDIA/SkillSpector

Release list