How ai-integr8tor/nvidia_skillspector works
SkillSpector scans AI-agent skills and answers whether they are safe to install. The documented workflow resolves local, archive, URL, or Git inputs; builds bounded scan context; runs static checks and optional semantic analysis; then scores and reports findings, with baseline suppression available. The tree also shows batch scanning, MCP and Pi integrations, and a pluggable model-provider layer. README capabilities guide this map; sampled source excerpts are partial, so uncertain internal wiring is omitted.
Main entry points: cli.py Scan CLI · build_context.py Scan context · analyzers Static analyzers · osv_client.py OSV lookup
Components 22
Scan workflow
- Input resolver
src/skillspector/input_handler.py - Scan context
src/skillspector/nodes/build_context.py - Finalize findings
src/skillspector/nodes/finalize_inspection_ledger.py - Baseline suppression
src/skillspector/suppression.py - Reports and scoring
src/skillspector/nodes/report.py
Analysis
- Static analyzers
src/skillspector/nodes/analyzers - OSV lookup
src/skillspector/nodes/analyzers/osv_client.py - Semantic analysis
src/skillspector/nodes/meta_analyzer.py - LLM analysis
src/skillspector/llm_analyzer_base.py - MCP registry
src/skillspector/mcp_registry.py
Model integrations
- Provider dispatch
src/skillspector/providers/registry.py - Provider adapters
src/skillspector/providers - Agent CLI adapter
src/skillspector/providers/_agent_cli.py
Interfaces
- Scan CLI
src/skillspector/cli.py - Batch scanner
contrib/batch_scan/batch_scan.py - MCP server
src/skillspector/mcp_server.py - Pi extension
extensions/skillspector.ts
Other components
- Engineer
- Model services
- OSV.dev
- Scan report
- Vulnerability data
Connections 27
- Engineer → Scan CLI: requests scan
- Scan CLI → Input resolver: resolves input
- Input resolver → Scan context: provides files
- Scan context → Static analyzers: supplies context
- Static analyzers → OSV lookup: checks packages
- OSV lookup → OSV.dev: queries
- OSV lookup → Vulnerability data: returns matches
- Scan context → Semantic analysis: supplies context
- Semantic analysis → LLM analysis: analyzes findings
- LLM analysis → Provider dispatch: requests inference
- Provider dispatch → Provider adapters: selects provider
- Provider dispatch → Agent CLI adapter: selects CLI adapter
- Provider adapters → Model services: calls model
- Agent CLI adapter → Model services: invokes agent CLI
- Static analyzers → Finalize findings: returns findings
- Semantic analysis → Finalize findings: returns findings
- Finalize findings → Baseline suppression: filters baseline
- Baseline suppression → Reports and scoring: provides findings
- Scan CLI → Reports and scoring: requests output
- Reports and scoring → Scan report: renders formats
- Engineer → Batch scanner: requests batch scan
- Batch scanner → Scan CLI: runs scans
- Engineer → MCP server: requests tool scan
- MCP server → Scan CLI: invokes scan
- MCP server → MCP registry: uses registry
- Engineer → Pi extension: requests tool scan
- Pi extension → Scan CLI: executes CLI