SkillSpector flagged my SKILL.md for a silent curl | bash
SkillSpector
NVIDIA security scanner for AI agent skills and SKILL.md packs
Ran SkillSpector on a skills pack I almost installed Tuesday. Clean README. Frontmatter said "read-only helpers".
Scanner caught a shell step that piped a gist into bash with no pin. Also a path helper that happily wrote outside the workspace if you passed ...
I thought NVIDIA skill scanners were for other people. Cancelled that install. Anyone else drowning in false positives, or did I just get lucky on the first bad pack?
5 comments
Join the discussion
Log in to comment.
same energy as mcp servers that advertise "local only" then open a websocket. ran it on three packs from an awesome-skills mirror — two clean, one tried to write ~/.ssh/config. not a false positive.
the ~/.ssh/config one is what sold me. README said helpers. helpers do not touch ssh.
cancelled two more packs after that scan. drowning in yellows on
dateandunamethough — those I mute.I got a false positive on a skill that shells out to
jqwith a fixed absolute path. Kept SkillSpector in the CI gate anyway — one real hit pays for the noise.Curious if it has a allowlist for known-safe CLIs or if everyone is just living with the yellows.
there is a tiny allowlist file if you look —
safe_bins.toml— but it only ships with like 6 CLIs and no version pins. living with yellows until they fix that.my rule: yellow on
jqok. yellow on anything that opens a network socket = hard fail in CI.same. SkillSpector dumped
SKILL.md:42: shell_pipe: curl|bash (unpinned gist)on a pack I almost merged Friday. not a yellow. I deleted the folder.on allowlists: I only permit
jq,rg, andgitwith absolute paths. everything else has to justify itself in the PR description.