# ai-integr8tor/nvidia_skillspector architecture

> Architecture diagram of the GitHub repository ai-integr8tor/nvidia_skillspector, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/ai-integr8tor/nvidia_skillspector
- Repository: https://github.com/ai-integr8tor/nvidia_skillspector

## Overview

SkillSpector scans AI-agent skills and answers whether they are safe to install. The documented workflow resolves local, archive, URL, or Git inputs; builds bounded scan context; runs static checks and optional semantic analysis; then scores and reports findings, with baseline suppression available. The tree also shows batch scanning, MCP and Pi integrations, and a pluggable model-provider layer. README capabilities guide this map; sampled source excerpts are partial, so uncertain internal wiring is omitted.

Main entry points: [`src/skillspector/cli.py`](https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/cli.py) (Scan CLI), [`src/skillspector/nodes/build_context.py`](https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/nodes/build_context.py) (Scan context), [`src/skillspector/nodes/analyzers`](https://github.com/ai-integr8tor/nvidia_skillspector/tree/main/src/skillspector/nodes/analyzers) (Static analyzers), [`src/skillspector/nodes/analyzers/osv_client.py`](https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/nodes/analyzers/osv_client.py) (OSV lookup)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_scan["Scan workflow"]
  node_input["Input resolver<br/>[input_handler.py]"]
  node_context["Scan context<br/>[build_context.py]"]
  node_finalize["Finalize findings"]
  node_suppression["Baseline suppression<br/>[suppression.py]"]
  node_report["Reports and scoring<br/>[report.py]"]
end

subgraph group_analysis["Analysis"]
  node_static["Static analyzers"]
  node_osv["OSV lookup<br/>[osv_client.py]"]
  node_semantic["Semantic analysis<br/>[meta_analyzer.py]"]
  node_llm["LLM analysis"]
  node_mcp_registry["MCP registry<br/>[mcp_registry.py]"]
end

subgraph group_models["Model integrations"]
  node_provider_dispatch["Provider dispatch<br/>[registry.py]"]
  node_provider_adapters["Provider adapters"]
  node_agent_cli["Agent CLI adapter<br/>[_agent_cli.py]"]
end

subgraph group_interfaces["Interfaces"]
  node_cli["Scan CLI<br/>[cli.py]"]
  node_batch["Batch scanner<br/>[batch_scan.py]"]
  node_mcp["MCP server<br/>[mcp_server.py]"]
  node_pi["Pi extension<br/>[skillspector.ts]"]
end

node_user(("Engineer"))
node_external_models{{"Model services"}}
node_external_osv{{"OSV.dev"}}
node_result["Scan report"]
node_osv_result["Vulnerability data"]

node_user -->|"requests scan"| node_cli
node_cli -->|"resolves input"| node_input
node_input -->|"provides files"| node_context
node_context -->|"supplies context"| node_static
node_static -.->|"checks packages"| node_osv
node_osv -.->|"queries"| node_external_osv
node_osv -.->|"returns matches"| node_osv_result
node_context -.->|"supplies context"| node_semantic
node_semantic -.->|"analyzes findings"| node_llm
node_llm -->|"requests inference"| node_provider_dispatch
node_provider_dispatch -->|"selects provider"| node_provider_adapters
node_provider_dispatch -.->|"selects CLI adapter"| node_agent_cli
node_provider_adapters -->|"calls model"| node_external_models
node_agent_cli -.->|"invokes agent CLI"| node_external_models
node_static -->|"returns findings"| node_finalize
node_semantic -.->|"returns findings"| node_finalize
node_finalize -->|"filters baseline"| node_suppression
node_suppression -->|"provides findings"| node_report
node_cli -->|"requests output"| node_report
node_report -->|"renders formats"| node_result
node_user -->|"requests batch scan"| node_batch
node_batch -->|"runs scans"| node_cli
node_user -->|"requests tool scan"| node_mcp
node_mcp -->|"invokes scan"| node_cli
node_mcp -->|"uses registry"| node_mcp_registry
node_user -->|"requests tool scan"| node_pi
node_pi -->|"executes CLI"| node_cli

click node_cli "https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/cli.py"
click node_input "https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/input_handler.py"
click node_context "https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/nodes/build_context.py"
click node_static "https://github.com/ai-integr8tor/nvidia_skillspector/tree/main/src/skillspector/nodes/analyzers"
click node_osv "https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/nodes/analyzers/osv_client.py"
click node_semantic "https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/nodes/meta_analyzer.py"
click node_llm "https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/llm_analyzer_base.py"
click node_provider_dispatch "https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/providers/registry.py"
click node_provider_adapters "https://github.com/ai-integr8tor/nvidia_skillspector/tree/main/src/skillspector/providers"
click node_agent_cli "https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/providers/_agent_cli.py"
click node_finalize "https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/nodes/finalize_inspection_ledger.py"
click node_suppression "https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/suppression.py"
click node_report "https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/nodes/report.py"
click node_batch "https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/contrib/batch_scan/batch_scan.py"
click node_mcp "https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/mcp_server.py"
click node_mcp_registry "https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/mcp_registry.py"
click node_pi "https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/extensions/skillspector.ts"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_input,node_context,node_finalize,node_suppression,node_report toneBlue
class node_static,node_osv,node_semantic,node_llm,node_mcp_registry toneAmber
class node_provider_dispatch,node_provider_adapters,node_agent_cli toneMint
class node_cli,node_batch,node_mcp,node_pi toneRose
class node_user,node_external_models,node_external_osv,node_result,node_osv_result toneIndigo
```

## Components

### Scan workflow

- [Input resolver](https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/input_handler.py): `src/skillspector/input_handler.py`
- [Scan context](https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/nodes/build_context.py): `src/skillspector/nodes/build_context.py`
- [Finalize findings](https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/nodes/finalize_inspection_ledger.py): `src/skillspector/nodes/finalize_inspection_ledger.py`
- [Baseline suppression](https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/suppression.py): `src/skillspector/suppression.py`
- [Reports and scoring](https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/nodes/report.py): `src/skillspector/nodes/report.py`

### Analysis

- [Static analyzers](https://github.com/ai-integr8tor/nvidia_skillspector/tree/main/src/skillspector/nodes/analyzers): `src/skillspector/nodes/analyzers`
- [OSV lookup](https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/nodes/analyzers/osv_client.py): `src/skillspector/nodes/analyzers/osv_client.py`
- [Semantic analysis](https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/nodes/meta_analyzer.py): `src/skillspector/nodes/meta_analyzer.py`
- [LLM analysis](https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/llm_analyzer_base.py): `src/skillspector/llm_analyzer_base.py`
- [MCP registry](https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/mcp_registry.py): `src/skillspector/mcp_registry.py`

### Model integrations

- [Provider dispatch](https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/providers/registry.py): `src/skillspector/providers/registry.py`
- [Provider adapters](https://github.com/ai-integr8tor/nvidia_skillspector/tree/main/src/skillspector/providers): `src/skillspector/providers`
- [Agent CLI adapter](https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/providers/_agent_cli.py): `src/skillspector/providers/_agent_cli.py`

### Interfaces

- [Scan CLI](https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/cli.py): `src/skillspector/cli.py`
- [Batch scanner](https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/contrib/batch_scan/batch_scan.py): `contrib/batch_scan/batch_scan.py`
- [MCP server](https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/src/skillspector/mcp_server.py): `src/skillspector/mcp_server.py`
- [Pi extension](https://github.com/ai-integr8tor/nvidia_skillspector/blob/main/extensions/skillspector.ts): `extensions/skillspector.ts`

### Other components

- **Engineer**
- **Model services**
- **OSV.dev**
- **Scan report**
- **Vulnerability data**

## Connections

- Engineer → Scan CLI: requests scan
- Scan CLI → Input resolver: resolves input
- Input resolver → Scan context: provides files
- Scan context → Static analyzers: supplies context
- Static analyzers → OSV lookup: checks packages
- OSV lookup → OSV.dev: queries
- OSV lookup → Vulnerability data: returns matches
- Scan context → Semantic analysis: supplies context
- Semantic analysis → LLM analysis: analyzes findings
- LLM analysis → Provider dispatch: requests inference
- Provider dispatch → Provider adapters: selects provider
- Provider dispatch → Agent CLI adapter: selects CLI adapter
- Provider adapters → Model services: calls model
- Agent CLI adapter → Model services: invokes agent CLI
- Static analyzers → Finalize findings: returns findings
- Semantic analysis → Finalize findings: returns findings
- Finalize findings → Baseline suppression: filters baseline
- Baseline suppression → Reports and scoring: provides findings
- Scan CLI → Reports and scoring: requests output
- Reports and scoring → Scan report: renders formats
- Engineer → Batch scanner: requests batch scan
- Batch scanner → Scan CLI: runs scans
- Engineer → MCP server: requests tool scan
- MCP server → Scan CLI: invokes scan
- MCP server → MCP registry: uses registry
- Engineer → Pi extension: requests tool scan
- Pi extension → Scan CLI: executes CLI