Issues

• semantic_security_discovery runs its batches one at a time

  NVIDIA/SkillSpector#854 · Filter by author elliottwaves-20 opened on Oct 17, 2026

• LLM batches for large files exceed MAX_INPUT_BYTES on CLI providers, so the scan never reaches a verdict

  NVIDIA/SkillSpector#853 · Filter by author elliottwaves-20 opened on Oct 17, 2026

• bedrock: mcp_tool_poisoning (TP4) fails with NotImplementedError when structured output returns None; run ends execution_successful=false, exit 2

  NVIDIA/SkillSpector#843 · Filter by author naamanhirschfeld-armis opened on Oct 15, 2026

• --recursive stops after 32 skills (hardcoded _MULTI_SKILL_MAX_SKILLS); cap is undocumented and cannot be raised

  NVIDIA/SkillSpector#842 · Filter by author naamanhirschfeld-armis opened on Oct 15, 2026
  1

• Registry mode silently ignores shipped-baseline and transitive options

  NVIDIA/SkillSpector#839 · Filter by author chrisknvidia opened on Oct 14, 2026
  

• E1 upload matcher borrows flags from independent commands

  NVIDIA/SkillSpector#838 · Filter by author chrisknvidia opened on Oct 14, 2026
  

• fix: align recursive aggregate risk recommendations with child reports

  NVIDIA/SkillSpector#835 · Filter by author chrisknvidia opened on Oct 14, 2026
  

• fix: MP3 flags descriptive hardware reset-state prose

  NVIDIA/SkillSpector#834 · Filter by author chrisknvidia opened on Oct 14, 2026
  

• TM1 flags the HTTP verb DELETE in REST route tables despite the pattern comment saying it avoids them

  NVIDIA/SkillSpector#832 · Filter by author jwcastillo opened on Oct 14, 2026

• PE3 flags .env entries inside ```gitignore code fences in Markdown

  NVIDIA/SkillSpector#830 · Filter by author jwcastillo opened on Oct 14, 2026

• Reject ignored shipped-baseline opt-in in recursive multi-skill scans

  NVIDIA/SkillSpector#822 · Filter by author chrisknvidia opened on Oct 13, 2026
  

• Support custom HTTP headers for OpenAICompatibleProvider

  NVIDIA/SkillSpector#821 · Filter by author jh49choi opened on Oct 13, 2026
  1

• E2 shell arm: known limits of the grep -v exemption after #483

  NVIDIA/SkillSpector#818 · Filter by author MandoCodes1 opened on Oct 12, 2026

• Quote in a heredoc body, comment or prose hides a later command line from the command-word scan

  NVIDIA/SkillSpector#813 · Filter by author elliottwaves-20 opened on Oct 9, 2026
  1

• CLI still reports zero-finding scans as partial/CAUTION when the only exceptions are reference_missing (#510 fixed MCP only)

  NVIDIA/SkillSpector#804 · Filter by author nigel-upstart opened on Oct 8, 2026
  1

• RP1 reads the first docker option as the image, and registry ports or option values as tags

  NVIDIA/SkillSpector#781 · Filter by author ilaigold opened on Oct 6, 2026

• RP1 misses unpinned npx in MCP server definitions (args array), but flags the same command in prose

  NVIDIA/SkillSpector#775 · Filter by author KazunoriNakajima opened on Oct 6, 2026

• Batch gap-fill findings do not update risk scores, verdicts, or exit status

  NVIDIA/SkillSpector#771 · Filter by author YMuskrat opened on Oct 6, 2026

• Malformed dependency manifests are reported as fully inspected

  NVIDIA/SkillSpector#769 · Filter by author YMuskrat opened on Oct 6, 2026

• Pipenv dependencies are skipped by SC4 despite complete scan reporting

  NVIDIA/SkillSpector#764 · Filter by author YMuskrat opened on Oct 6, 2026

• Compacted findings reuse another occurrence’s source snippet in reports

  NVIDIA/SkillSpector#759 · Filter by author YMuskrat opened on Oct 5, 2026
  1

• False positive: info_stealer $browser_cookies matches prose that mentions cookies and Edge on one line

  NVIDIA/SkillSpector#751 · Filter by author elliottwaves-20 opened on Oct 5, 2026

• taint tracking: keep a set of sources per name so reassignment can't drop the stronger TT rule

  NVIDIA/SkillSpector#750 · Filter by author udsy19 opened on Oct 5, 2026

• TT3: credential sent through urllib.request.build_opener(...).open() is not reported

  NVIDIA/SkillSpector#714 · Filter by author jamesjsanders opened on Oct 3, 2026
  2

• opencode_cli version range 1.18.31-1.18.34

  NVIDIA/SkillSpector#712 · Filter by author Yoseph-Zuskin opened on Oct 3, 2026
  1