Safety rating · all ratings

NVIDIA/SkillSpector

Score 67/100 — Moderate public signals

Automated checks of public signals as of the date shown. Not a security audit, certification or endorsement, and not a statement about the people who maintain the project. Signals can be incomplete or out of date; each check shows its evidence and source so anyone can verify it.

Score 67/100 — Moderate public signals. As of 2026-10-31T00:22:29.010Z (check version rs-safety-checks-1.0). Repository: https://github.com/NVIDIA/SkillSpector

Checks

• License present (OSI-approved) — Found (10/10): GitHub detects license Apache-2.0 (OSI-approved). Source: https://api.github.com/repos/NVIDIA/SkillSpector
• Security policy (SECURITY.md) — Found (8/8): Security policy at SECURITY.md. Source: https://github.com/NVIDIA/SkillSpector/blob/main/SECURITY.md
• Known advisories in pinned dependencies (OSV) — Partly found (0/15): 161 pinned packages checked against OSV; 14 have at least one matching advisory (cryptography@49.0.0: GHSA-g6cj-pr64-35w5, PYSEC-2026-3552; dulwich@1.2.6: GHSA-35mr-4567-66vg, GHSA-5fqc-mrg8-w798; filelock@3.29.4: GHSA-567q-5qvw-pf92, GHSA-69hj-f68j-2879; langgraph@1.2.6: GHSA-3fx2-cqw9-xr3c; langgraph-api@0.10.0: GHSA-4hm6-w6qq-w73v; …). An advisory match does not mean the project is exploitable. Source: https://osv.dev
• OpenSSF Scorecard — Found (7/12): OpenSSF Scorecard 5.8/10 (published 2026-10-30). Source: https://scorecard.dev/viewer/?uri=github.com/NVIDIA/SkillSpector
• Signed releases or build provenance — Not found (0/8): No signature, attestation or provenance signals in workflows or in the last 5 releases. Source: https://api.github.com/repos/NVIDIA/SkillSpector/releases
• Continuous integration present — Found (8/8): 4 CI configuration file(s), e.g. .github/workflows/ci.yml, .github/workflows/release.yml, .github/workflows/scorecard.yml. Source: https://github.com/NVIDIA/SkillSpector/blob/main/.github/workflows/ci.yml
• Credential-pattern scan — Found (12/12): No credential patterns matched in 33 scanned files (root-level and one-deep text files (≤60, <200KB each) plus up to 15 workflow files at the default branch head); no credential-like file names. Source: https://api.github.com/repos/NVIDIA/SkillSpector/git/trees/main?recursive=1
• Pinned dependencies — Partly found (7/9): Lockfiles: uv.lock. GitHub Actions pinned to a commit SHA: 15/15. Automated update config: none found. Source: https://api.github.com/repos/NVIDIA/SkillSpector/git/trees/main?recursive=1
• Maintainer activity — Found (10/10): Last commit 0 day(s) before the check; 100+ commits by 25 distinct author(s) in the prior 90 days. Source: https://api.github.com/repos/NVIDIA/SkillSpector/commits
• MCP: tool permissions, access scope and injection notes — Partly found (5/8): Tool annotations (readOnlyHint) in code: not found. README mentions of access scope: read-only, sandbox, permission, scope. README notes on prompt injection / untrusted input: prompt injection, untrusted. Source: https://github.com/search?q=readOnlyHint+repo%3ANVIDIA%2FSkillSpector&type=code

Ledger

• Entry #3769 at 2026-10-31T00:39:55.936Z: score 67, rs-safety-checks-1.0, rating c8b5b03f9b14f734…

Maintainers

Are you a maintainer? Request a free re-check after changes, or send a response: POST https://www.rightshold.com/v1/safety-ratings/NVIDIA/SkillSpector/recheck. Badge: https://www.rightshold.com/v1/safety-ratings/NVIDIA/SkillSpector/badge.svg