Repository Analysis

NVIDIA/SkillSpector

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks.

64.7 Strong AI signal View on GitHub

Analysis Overview

This report presents the forensic synthetic code analysis of NVIDIA/SkillSpector, a Python project with 13,135 GitHub stars. SynthScan v2.0 examined 48,354 lines of code across 191 source files, recording 1947 pattern matches distributed across 18 syntactic categories. The overall adjusted score of 64.7 places this repository in the Strong AI signal band.

The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).

64.7
Adjusted Score
64.7
Raw Score
100%
Time Factor
2026-07-14
Last Push
13.1K
Stars
Python
Language
48.4K
Lines of Code
191
Files
1.9K
Pattern Hits
2026-07-14
Scan Date
0.06
HC Hit Rate

What These Metrics Mean

Adjusted Score
Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score
The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor
The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits
Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate
High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files
Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 0HIGH 12MEDIUM 498LOW 1437

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 1947 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Decorative Section Separators486 hits · 1684 pts
SeverityFileLineSnippetContext
MEDIUMtests/test_mcp_tool_poisoning.py395# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_mcp_tool_poisoning.py397# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_mcp_tool_poisoning.py713# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_mcp_tool_poisoning.py715# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_mcp_tool_poisoning.py29# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_mcp_tool_poisoning.py31# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_mcp_tool_poisoning.py194# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_mcp_tool_poisoning.py196# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_mcp_tool_poisoning.py312# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_mcp_tool_poisoning.py314# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_mcp_tool_poisoning.py558# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_mcp_tool_poisoning.py560# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_mcp_tool_poisoning.py612# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_mcp_tool_poisoning.py614# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_mcp_least_privilege.py27# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_mcp_least_privilege.py29# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_mcp_least_privilege.py169# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/test_mcp_least_privilege.py171# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py117# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py119# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py141# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py143# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py220# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py222# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py258# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py260# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py304# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py306# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py333# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py335# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py371# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py373# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py524# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py526# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py536# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py538# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py549# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py551# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py638# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py640# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py58# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py60# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py599# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_agent_cli.py601# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_model_info.py65# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_model_info.py67# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_model_info.py86# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_model_info.py88# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_model_info.py164# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_model_info.py166# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_model_info.py246# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_model_info.py248# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_model_info.py278# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_model_info.py280# ---------------------------------------------------------------------------COMMENT
MEDIUMtests/unit/test_patterns_new.py1131# ── Supply Chain Helpers ───────────────────────────────────────────────COMMENT
MEDIUMtests/unit/test_patterns_new.py52# ── Helpers ─────────────────────────────────────────────────────────────COMMENT
MEDIUMtests/unit/test_patterns_new.py81# ── Excessive Agency (EA1–EA4) ─────────────────────────────────────────COMMENT
MEDIUMtests/unit/test_patterns_new.py211# ── Output Handling (OH1–OH3) ──────────────────────────────────────────COMMENT
MEDIUMtests/unit/test_patterns_new.py300# ── System Prompt Leakage (P6–P8) ──────────────────────────────────────COMMENT
MEDIUMtests/unit/test_patterns_new.py366# ── Memory Poisoning (MP1–MP3) ─────────────────────────────────────────COMMENT
426 more matches not shown…
Hyper-Verbose Identifiers1013 hits · 956 pts
SeverityFileLineSnippetContext
LOWtests/test_mcp_tool_poisoning.py401 def test_injection_in_param_description(self):CODE
LOWtests/test_mcp_tool_poisoning.py700 def test_no_llm_call_attempted_records_nothing(self):CODE
LOWtests/test_mcp_tool_poisoning.py707 def test_use_llm_false_records_nothing(self):CODE
LOWtests/test_mcp_tool_poisoning.py272 def test_data_uri_in_metadata(self):CODE
LOWtests/test_mcp_tool_poisoning.py290 def test_instruction_keyword_in_comment(self):CODE
LOWtests/test_mcp_tool_poisoning.py376 def test_invisible_formatting_chars(self):CODE
LOWtests/test_mcp_tool_poisoning.py421 def test_system_token_in_param(self):CODE
LOWtests/test_mcp_tool_poisoning.py444 def test_exfiltration_in_param_description(self):CODE
LOWtests/test_mcp_tool_poisoning.py466 def test_malicious_default_value(self):CODE
LOWtests/test_mcp_tool_poisoning.py489 def test_excessive_description_length(self):CODE
LOWtests/test_mcp_tool_poisoning.py517 def test_localhost_prefixed_attacker_url_is_flagged(self):CODE
LOWtests/test_mcp_tool_poisoning.py540 def test_genuine_loopback_default_url_is_exempt(self):CODE
LOWtests/test_mcp_tool_poisoning.py640 def test_skipped_no_description(self):CODE
LOWtests/test_mcp_tool_poisoning.py646 def test_llm_call_failure_returns_empty(self):CODE
LOWtests/test_mcp_tool_poisoning.py658 def test_unparseable_response_returns_empty(self):CODE
LOWtests/test_mcp_tool_poisoning.py675 def test_successful_call_records_ok_true(self):CODE
LOWtests/test_mcp_tool_poisoning.py686 def test_failed_call_records_ok_false(self):CODE
LOWtests/test_mcp_tool_poisoning.py726 def test_full_pipeline_poisoned_skill(self):CODE
LOWtests/test_mcp_tool_poisoning.py744 def test_full_pipeline_clean_skill(self):CODE
LOWtests/test_mcp_tool_poisoning.py761 def test_sarif_output_contains_tp_rules(self):CODE
LOWtests/conftest.py25def mock_resolve_context_length():CODE
LOWtests/test_mcp_rug_pull.py129def test_empty_state_returns_no_findings():CODE
LOWtests/test_mcp_least_privilege.py191 def test_underdeclared_detected(self):CODE
LOWtests/test_mcp_least_privilege.py248 def test_no_permissions_field(self):CODE
LOWtests/test_mcp_least_privilege.py329 def test_over_declared_detected(self):CODE
LOWtests/test_mcp_least_privilege.py371 def test_docs_only_skill_skips(self):CODE
LOWtests/test_mcp_least_privilege.py405 def test_permission_matching_case_insensitive(self):CODE
LOWtests/test_multi_skill.py71 def test_multi_skill_directory_detected(self, multi_skill_dir: Path) -> None:CODE
LOWtests/test_multi_skill.py78 def test_skill_names_extracted_from_frontmatter(self, multi_skill_dir: Path) -> None:CODE
LOWtests/test_multi_skill.py84 def test_single_skill_not_multi(self, single_skill_dir: Path) -> None:CODE
LOWtests/test_multi_skill.py91 def test_root_skill_overrides_nested(self, nested_with_root: Path) -> None:CODE
LOWtests/test_multi_skill.py97 def test_empty_directory_not_multi(self, tmp_path: Path) -> None:CODE
LOWtests/test_multi_skill.py103 def test_single_sub_skill_not_multi(self, tmp_path: Path) -> None:CODE
LOWtests/test_multi_skill.py112 def test_hidden_directories_skipped(self, tmp_path: Path) -> None:CODE
LOWtests/test_multi_skill.py132 def test_skill_directory_paths_are_absolute(self, multi_skill_dir: Path) -> None:CODE
LOWtests/test_multi_skill.py138 def test_relative_path_is_dirname(self, multi_skill_dir: Path) -> None:CODE
LOWtests/test_multi_skill.py145 def test_fallback_name_from_dirname(self, tmp_path: Path) -> None:CODE
LOWtests/test_multi_skill.py156 def test_lowercase_skill_md_detected(self, tmp_path: Path) -> None:CODE
LOWtests/unit/test_agent_cli.py128 def test_label_starting_with_dash_raises(self) -> None:CODE
LOWtests/unit/test_agent_cli.py136 def test_label_with_special_chars_raises(self) -> None:CODE
LOWtests/unit/test_agent_cli.py147 def test_shell_false_implied_by_list(self) -> None:CODE
LOWtests/unit/test_agent_cli.py170 def test_model_flag_omitted_when_empty(self) -> None:CODE
LOWtests/unit/test_agent_cli.py176 def test_allowed_tools_deny_by_default(self) -> None:CODE
LOWtests/unit/test_agent_cli.py185 def test_permission_mode_dont_ask(self) -> None:CODE
LOWtests/unit/test_agent_cli.py191 def test_strict_mcp_config_present(self) -> None:CODE
LOWtests/unit/test_agent_cli.py203 def test_disable_slash_commands_present(self) -> None:CODE
LOWtests/unit/test_agent_cli.py207 def test_dangerously_skip_permissions_never_in_argv(self) -> None:CODE
LOWtests/unit/test_agent_cli.py214 def test_no_injection_in_argv(self) -> None:CODE
LOWtests/unit/test_agent_cli.py244 def test_ignore_user_config_present(self) -> None:CODE
LOWtests/unit/test_agent_cli.py248 def test_ignore_rules_present(self) -> None:CODE
LOWtests/unit/test_agent_cli.py252 def test_dangerous_bypass_never_present(self) -> None:CODE
LOWtests/unit/test_agent_cli.py264 def test_strips_anthropic_api_key(self, monkeypatch: pytest.MonkeyPatch) -> None:CODE
LOWtests/unit/test_agent_cli.py269 def test_strips_openai_api_key(self, monkeypatch: pytest.MonkeyPatch) -> None:CODE
LOWtests/unit/test_agent_cli.py274 def test_strips_nvidia_inference_key(self, monkeypatch: pytest.MonkeyPatch) -> None:CODE
LOWtests/unit/test_agent_cli.py279 def test_strips_aws_credentials(self, monkeypatch: pytest.MonkeyPatch) -> None:CODE
LOWtests/unit/test_agent_cli.py286 def test_strips_ssh_auth_sock(self, monkeypatch: pytest.MonkeyPatch) -> None:CODE
LOWtests/unit/test_agent_cli.py313 def test_returns_response_text(self) -> None:CODE
LOWtests/unit/test_agent_cli.py316 def test_strips_surrounding_whitespace(self) -> None:CODE
LOWtests/unit/test_agent_cli.py323 def test_whitespace_only_raises(self) -> None:CODE
LOWtests/unit/test_agent_cli.py327 def test_multiline_response_preserved(self) -> None:CODE
953 more matches not shown…
Unused Imports174 hits · 158 pts
SeverityFileLineSnippetContext
LOWtests/test_mcp_tool_poisoning.py18CODE
LOWtests/test_mcp_rug_pull.py18CODE
LOWtests/test_mcp_least_privilege.py18CODE
LOWtests/test_multi_skill.py18CODE
LOWtests/unit/test_agent_cli.py34CODE
LOWtests/unit/test_llm_utils.py23CODE
LOWtests/unit/test_providers.py23CODE
LOWtests/unit/test_suppression.py18CODE
LOWtests/unit/test_model_info.py18CODE
LOWtests/unit/test_model_info.py33CODE
LOWtests/unit/test_osv_client.py18CODE
LOWtests/unit/test_input_handler_ssrf.py18CODE
LOWtests/unit/test_bedrock_provider.py24CODE
LOWtests/unit/test_anthropic_proxy_provider.py18CODE
LOWtests/unit/test_constants.py18CODE
LOWtests/unit/test_sarif.py18CODE
LOWtests/unit/test_patterns_new.py22CODE
LOWtests/nodes/test_deduplicate.py18CODE
LOWtests/nodes/test_analysis_completeness.py18CODE
LOWtests/nodes/test_llm_analyzer_base.py18CODE
LOWtests/nodes/test_report.py18CODE
LOWtests/nodes/test_sarif_rules_and_empty_findings.py18CODE
LOWtests/nodes/test_meta_analyzer_fallback.py18CODE
LOWtests/nodes/test_meta_analyzer.py23CODE
LOWtests/nodes/test_build_context.py21CODE
LOWtests/nodes/test_report_sanitizer.py18CODE
LOWtests/nodes/test_semantic_quality_policy.py18CODE
LOWtests/nodes/analyzers/test_mp2_regex_backtracking.py18CODE
LOWtests/nodes/analyzers/test_registry.py18CODE
LOWtests/nodes/analyzers/test_behavioral_ast.py18CODE
LOWtests/nodes/analyzers/test_semantic_developer_intent.py18CODE
LOWtests/nodes/analyzers/conftest.py18CODE
LOWtests/nodes/analyzers/test_static_runner_filtering.py18CODE
LOWtests/nodes/analyzers/test_static_patterns.py18CODE
LOW…ts/nodes/analyzers/test_semantic_security_discovery.py18CODE
LOWtests/nodes/analyzers/test_mcp_rug_pull.py18CODE
LOW…s/nodes/analyzers/test_static_patterns_anti_refusal.py18CODE
LOWtests/nodes/analyzers/test_binary_and_pe3_filtering.py18CODE
LOWtests/nodes/analyzers/test_static_yara.py22CODE
LOWtests/nodes/analyzers/test_behavioral_taint_tracking.py18CODE
LOWtests/integration/test_agent_cli_live.py51CODE
LOWtests/provider/test_provider_endpoint.py18CODE
LOWcontrib/batch_scan/detection.py28CODE
LOWcontrib/batch_scan/annotation.py22CODE
LOWcontrib/batch_scan/runner.py32CODE
LOWcontrib/batch_scan/runner.py35CODE
LOWcontrib/batch_scan/batch_scan.py48CODE
LOWcontrib/batch_scan/discovery.py22CODE
LOWcontrib/batch_scan/__init__.py34CODE
LOWcontrib/batch_scan/__init__.py47CODE
LOWcontrib/batch_scan/__init__.py47CODE
LOWcontrib/batch_scan/__init__.py48CODE
LOWcontrib/batch_scan/__init__.py48CODE
LOWcontrib/batch_scan/__init__.py48CODE
LOWcontrib/batch_scan/__init__.py48CODE
LOWcontrib/batch_scan/__init__.py49CODE
LOWcontrib/batch_scan/__init__.py49CODE
LOWcontrib/batch_scan/__init__.py50CODE
LOWcontrib/batch_scan/__init__.py51CODE
LOWcontrib/batch_scan/__init__.py51CODE
114 more matches not shown…
Over-Commented Block165 hits · 152 pts
SeverityFileLineSnippetContext
LOWmodel_registry.yaml1# Model registry — context window and output token limits.COMMENT
LOW.skillspector-baseline.example.yaml1# SkillSpector baseline (example)COMMENT
LOWtests/test_mcp_tool_poisoning.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/conftest.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/__init__.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/test_mcp_rug_pull.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/test_mcp_least_privilege.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/test_multi_skill.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/unit/test_agent_cli.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/unit/test_mcp_server.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/unit/test_llm_utils.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/unit/test_providers.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/unit/test_suppression.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/unit/test_patterns.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/unit/__init__.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/unit/test_model_info.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/unit/test_osv_client.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/unit/test_input_handler_ssrf.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/unit/test_bedrock_provider.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/unit/test_reviewer_nits.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/unit/test_anthropic_proxy_provider.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/unit/test_cli.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/unit/test_constants.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/unit/test_input_handler.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/unit/test_sarif.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/unit/test_patterns_new.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/test_deduplicate.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/test_analysis_completeness.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/test_llm_analyzer_base.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/__init__.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/test_report.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/test_sarif_rules_and_empty_findings.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/test_resolve_input.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/test_meta_analyzer_fallback.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/test_meta_analyzer.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/test_build_context.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/test_report_sanitizer.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/test_semantic_quality_policy.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/analyzers/test_mp2_regex_backtracking.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/analyzers/test_registry.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/analyzers/test_behavioral_ast.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/analyzers/test_semantic_developer_intent.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/analyzers/conftest.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/analyzers/test_static_runner_filtering.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/analyzers/test_static_patterns.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOW…ts/nodes/analyzers/test_semantic_security_discovery.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/analyzers/test_mcp_rug_pull.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOW…s/nodes/analyzers/test_static_patterns_anti_refusal.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/analyzers/test_binary_and_pe3_filtering.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/analyzers/test_static_yara.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/nodes/analyzers/test_behavioral_taint_tracking.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/integration/conftest.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/integration/test_meta_analyzer_use_llm.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/integration/test_graph_scanner.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/integration/__init__.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/integration/test_agent_cli_live.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/integration/test_graph.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/provider/__init__.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtests/provider/test_provider_endpoint.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWcontrib/batch_scan/detection.py1# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
105 more matches not shown…
Excessive Try-Catch Wrapping33 hits · 30 pts
SeverityFileLineSnippetContext
LOWtests/unit/test_input_handler_ssrf.py145 except Exception:CODE
LOWdocs/LLM_ANALYZER_BASE_GUIDE.md89 except Exception as e:CODE
LOWcontrib/batch_scan/runner.py155 except Exception as exc:CODE
LOWcontrib/batch_scan/runner.py200 except Exception as exc:CODE
LOWcontrib/batch_scan/runner.py756 except Exception as exc:CODE
LOWcontrib/batch_scan/batch_scan.py371 except Exception:CODE
LOWcontrib/batch_scan/api_pool.py456 except Exception as exc:CODE
LOWcontrib/batch_scan/api_pool.py491 except Exception as exc:CODE
LOWcontrib/batch_scan/gap_fill.py237 except Exception as exc:CODE
LOWcontrib/batch_scan/gap_fill.py303 except Exception as exc:CODE
LOW…trib/batch_scan/tests/test_monkeypatch_invasiveness.py281 except Exception as exc:CODE
LOWcontrib/batch_scan/tests/tests-pro/mutation_max.py479 except Exception:CODE
LOWcontrib/batch_scan/tests/tests-pro/mutation_max.py321 except Exception:CODE
LOWcontrib/batch_scan/tests/tests-pro/mutation_max.py349 except Exception:CODE
LOWcontrib/batch_scan/tests/tests-pro/mutation_max.py396 except Exception:CODE
MEDIUMcontrib/batch_scan/tests/tests-pro/test_api_pool.py400def worker():CODE
LOWcontrib/batch_scan/tests/tests-pro/test_api_pool.py407 except Exception as e:CODE
MEDIUM…trib/batch_scan/tests/tests-pro/test_runner_patches.py393def test_chatopenai_init_receives_both_timeout_and_request_timeout(self):CODE
LOW…trib/batch_scan/tests/tests-pro/test_runner_patches.py469 except Exception:CODE
LOWcontrib/batch_scan/docs/DESIGN.md164except Exception:CODE
LOWcontrib/batch_scan/docs/archive/PITFALLS.md120except Exception:CODE
LOWsrc/skillspector/cli.py340 except Exception as e:CODE
LOWsrc/skillspector/cli.py400 except Exception as e:CODE
LOWsrc/skillspector/cli.py575 except Exception as e:CODE
LOWsrc/skillspector/nodes/meta_analyzer.py572 except Exception as e:CODE
LOW…spector/nodes/analyzers/semantic_security_discovery.py105 except Exception as exc:CODE
LOWsrc/skillspector/nodes/analyzers/static_yara.py246 except Exception as exc:CODE
LOW…killspector/nodes/analyzers/semantic_quality_policy.py153 except Exception as exc:CODE
LOW…llspector/nodes/analyzers/semantic_developer_intent.py184 except Exception as exc:CODE
LOWsrc/skillspector/nodes/analyzers/mcp_tool_poisoning.py816 except Exception as exc:CODE
LOWsrc/skillspector/nodes/analyzers/mcp_tool_poisoning.py274 except Exception:CODE
LOWsrc/skillspector/nodes/analyzers/mcp_tool_poisoning.py322 except Exception:CODE
LOWsrc/skillspector/providers/registry.py57 except Exception:CODE
Cross-Language Confusion5 hits · 25 pts
SeverityFileLineSnippetContext
HIGHtests/unit/test_patterns_new.py572 pytest.param("ls && rm -rf /tmp", "cleanup.sh", "shell", id="chain_rm"),CODE
HIGHtests/unit/test_patterns_new.py618 "RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*\n"CODE
HIGHtests/unit/test_patterns_new.py632 "RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*\n"CODE
HIGHtests/unit/test_patterns_new.py646 "RUN useradd --create-home appuser && chown -R appuser:appuser /app\n"CODE
HIGHcontrib/batch_scan/runner.py214 '"end_line": null, "confidence": 0.0-1.0, 'CODE
Deep Nesting26 hits · 22 pts
SeverityFileLineSnippetContext
LOWtests/test_mcp_tool_poisoning.py86CODE
LOWtests/test_mcp_least_privilege.py84CODE
LOWcontrib/batch_scan/detection.py50CODE
LOWcontrib/batch_scan/batch_scan.py192CODE
LOWcontrib/batch_scan/api_pool.py165CODE
LOWcontrib/batch_scan/reports.py309CODE
LOWcontrib/batch_scan/tests/tests-pro/mutation_max.py120CODE
LOWsrc/skillspector/cli.py369CODE
LOWsrc/skillspector/input_handler.py243CODE
LOWsrc/skillspector/nodes/meta_analyzer.py364CODE
LOW…tor/nodes/analyzers/static_patterns_harmful_content.py85CODE
LOW…tor/nodes/analyzers/static_patterns_harmful_content.py198CODE
LOWsrc/skillspector/nodes/analyzers/mcp_least_privilege.py208CODE
LOW…or/nodes/analyzers/static_patterns_prompt_injection.py200CODE
LOW…llspector/nodes/analyzers/behavioral_taint_tracking.py290CODE
LOW…llspector/nodes/analyzers/behavioral_taint_tracking.py320CODE
LOW…pector/nodes/analyzers/static_patterns_supply_chain.py456CODE
LOW…pector/nodes/analyzers/static_patterns_supply_chain.py742CODE
LOW…pector/nodes/analyzers/static_patterns_anti_refusal.py125CODE
LOWsrc/skillspector/nodes/analyzers/common.py208CODE
LOWsrc/skillspector/nodes/analyzers/common.py239CODE
LOWsrc/skillspector/nodes/analyzers/mcp_rug_pull.py363CODE
LOWsrc/skillspector/nodes/analyzers/static_runner.py252CODE
LOWsrc/skillspector/nodes/analyzers/behavioral_ast.py151CODE
LOWsrc/skillspector/nodes/analyzers/mcp_tool_poisoning.py344CODE
LOWsrc/skillspector/providers/_agent_cli.py322CODE
Modern AI Meta-Vocabulary7 hits · 20 pts
SeverityFileLineSnippetContext
MEDIUMmodel_registry.yaml1# Model registry — context window and output token limits.COMMENT
MEDIUMmodel_registry.yaml10# context_length: <int> # total context window in tokens (required)COMMENT
MEDIUMdocs/LLM_ANALYZER_BASE_GUIDE.md627 context_length: 128000 # total context window in tokens (required)CODE
MEDIUMsrc/skillspector/providers/bedrock/model_registry.yaml8# context_length: <int> # total context window in tokens (required)COMMENT
MEDIUMsrc/skillspector/providers/nv_build/model_registry.yaml8# context_length: <int> # total context window in tokens (required)COMMENT
MEDIUM…c/skillspector/providers/anthropic/model_registry.yaml8# context_length: <int> # total context window in tokens (required)COMMENT
MEDIUMsrc/skillspector/providers/openai/model_registry.yaml8# context_length: <int> # total context window in tokens (required)COMMENT
Cross-File Repetition4 hits · 20 pts
SeverityFileLineSnippetContext
HIGHsrc/skillspector/providers/bedrock/provider.py0resolve model: ``skillspector_model`` env > slot default > ``default_model``.STRING
HIGHsrc/skillspector/providers/nv_build/provider.py0resolve model: ``skillspector_model`` env > slot default > ``default_model``.STRING
HIGHsrc/skillspector/providers/anthropic/provider.py0resolve model: ``skillspector_model`` env > slot default > ``default_model``.STRING
HIGHsrc/skillspector/providers/openai/provider.py0resolve model: ``skillspector_model`` env > slot default > ``default_model``.STRING
Modern Structural Boilerplate18 hits · 19 pts
SeverityFileLineSnippetContext
LOWcontrib/batch_scan/runner.py58def set_api_pool(pool: "ApiKeyPool | None") -> None:CODE
LOWcontrib/batch_scan/__init__.py54__all__ = [CODE
LOWsrc/skillspector/logging_config.py64def set_level(level: int | str) -> None:CODE
LOWsrc/skillspector/constants.py23logger = logging.getLogger(__name__)CODE
LOWsrc/skillspector/__init__.py37__all__ = ["create_graph", "graph", "__version__"]CODE
LOWsrc/skillspector/nodes/analyzers/__init__.py132__all__ = ["ANALYZER_NODE_IDS", "ANALYZER_NODES"]CODE
LOWsrc/skillspector/nodes/analyzers/mcp_tool_poisoning.py36logger = logging.getLogger(__name__)CODE
LOWsrc/skillspector/providers/chat_models.py27logger = logging.getLogger(__name__)CODE
LOWsrc/skillspector/providers/__init__.py242__all__ = [CODE
LOWsrc/skillspector/providers/codex_cli/__init__.py29__all__ = ["CodexCLIProvider"]CODE
LOWsrc/skillspector/providers/anthropic_proxy/__init__.py20__all__ = ["REGISTRY_PATH", "AnthropicProxyProvider"]CODE
LOWsrc/skillspector/providers/bedrock/__init__.py25__all__ = [CODE
LOWsrc/skillspector/providers/claude_cli/__init__.py25__all__ = ["ClaudeCLIProvider"]CODE
LOWsrc/skillspector/providers/gemini_cli/__init__.py22__all__ = ["GeminiCLIProvider"]CODE
LOWsrc/skillspector/providers/nv_build/__init__.py20__all__ = ["BUILD_BASE_URL", "REGISTRY_PATH", "NvBuildProvider"]CODE
LOWsrc/skillspector/providers/antigravity_cli/__init__.py22__all__ = ["AntigravityCLIProvider"]CODE
LOWsrc/skillspector/providers/anthropic/__init__.py20__all__ = ["ANTHROPIC_BASE_URL", "REGISTRY_PATH", "AnthropicProvider"]CODE
LOWsrc/skillspector/providers/openai/__init__.py20__all__ = ["OPENAI_DEFAULT_BASE_URL", "REGISTRY_PATH", "OpenAIProvider"]CODE
Docstring Block Structure3 hits · 15 pts
SeverityFileLineSnippetContext
HIGHsrc/skillspector/llm_utils.py301 Run an async coroutine in a synchronous context, even if there's already a running event loop. This function sSTRING
HIGHsrc/skillspector/input_handler.py95 Resolve input to a scannable directory. Args: input_path: Path or URL to resolve STRING
HIGHsrc/skillspector/providers/_agent_cli.py708Run an agent CLI and return the assistant response text. This is the single security-hardened entry point. All secSTRING
Self-Referential Comments2 hits · 9 pts
SeverityFileLineSnippetContext
MEDIUM…trib/batch_scan/tests/tests-pro/test_runner_patches.py445 # Create a loop via _patched_asyncio_run — it calls _make_quiet_loop internallyCOMMENT
MEDIUM…trib/batch_scan/tests/tests-pro/test_runner_patches.py454 # Create a loop, then manually invoke the quiet-loop logic from the patchCOMMENT
Verbosity Indicators3 hits · 6 pts
SeverityFileLineSnippetContext
LOWcontrib/batch_scan/api_pool.py198 # Step 1: recover rate-limited keys whose backoff has expiredCOMMENT
LOWcontrib/batch_scan/api_pool.py201 # Step 2: find available keys (not rate-limited, slots open)COMMENT
LOWcontrib/batch_scan/api_pool.py219 # Step 3: no capacity — compute wait timeCOMMENT
Structural Annotation Overuse3 hits · 6 pts
SeverityFileLineSnippetContext
LOWcontrib/batch_scan/api_pool.py198 # Step 1: recover rate-limited keys whose backoff has expiredCOMMENT
LOWcontrib/batch_scan/api_pool.py201 # Step 2: find available keys (not rate-limited, slots open)COMMENT
LOWcontrib/batch_scan/api_pool.py219 # Step 3: no capacity — compute wait timeCOMMENT
AI Slop Vocabulary1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMtests/integration/test_agent_cli_live.py59#: Real ``stdin -> stdout`` agent CLIs this harness can drive. Add a new CLI hereCOMMENT
Overly Generic Function Names2 hits · 2 pts
SeverityFileLineSnippetContext
LOWtests/unit/test_anthropic_proxy_provider.py146 def handle_request(self, request: httpx.Request) -> httpx.Response:CODE
LOWsrc/skillspector/providers/anthropic_proxy/provider.py108 def handle_request(self, request: httpx.Request) -> httpx.Response:CODE
Redundant / Tautological Comments1 hit · 2 pts
SeverityFileLineSnippetContext
LOWsrc/skillspector/nodes/analyzers/mcp_tool_poisoning.py258 # Check if this match overlaps with a data URI rangeCOMMENT
AI Structural Patterns1 hit · 1 pts
SeverityFileLineSnippetContext
LOWsrc/skillspector/cli.py185CODE