SkillSpector Review v2: a layered pre-install gate
The current global skill expands a scanner run into a defensible review procedure: collect registry evidence in parallel, scan the exact artifact, test prompt-injection leads, and state precisely what any semantic reviewer was allowed to see.
V2
The skill now records a chain of evidence
The original demonstration explained discovery metadata, implicit activation, an ordered static scan, and explicit authority boundaries. This version keeps those foundations and adds three controls that materially change how a review should be interpreted.
Registry audit evidence, SkillSpector static analysis, OWASP prompt-injection triage, and an authorization-aware semantic assessment contribute different signals. None is presented as a security certificate or a substitute for artifact identity.
Start with the v1 anatomy guide if you want the shorter explanation of how a Codex skill is structured and discovered.
Build the review stack around the exact artifact
- Registry evidenceRun the skills.sh security check in parallel and retain Gen Agent Trust Hub, Socket, and Snyk findings with their dates and gaps.
- Local static scanRefresh SkillSpector from NVIDIA's upstream origin and scan before installing or executing untrusted content.
- OWASP triageUse direct patterns as leads, then inspect the attack classes that regular expressions cannot clear.
- Semantic assessmentUse local Codex by default or an explicitly approved external reviewer, then label the actual review coverage.
A mutable repository URL is useful for preliminary screening. A final decision needs the intended commit and the relevant checked-out skill directory. Registry results and URL scans may describe a different snapshot or a broader monorepo.
Run deterministic checks before semantic review
The first local artifact review is intentionally static-only. It is fast, repeatable, and does not require sending the target to an LLM provider.
skillspector scan TARGET \
--no-llm \
--format json \
--output REPORT.jsonContinue the requested review
- Exit 0 means the score is 50 or lower, not that the artifact is proven safe.
- Read findings, confidence, completeness, degradation, and suppressed evidence.
- Keep the JSON report outside the target repository unless durable evidence was requested.
Stop before use
- Exit 1 means the score is above 50 and blocks installation or execution.
- Exit 2 means the scan failed and its coverage is incomplete.
- High or critical evidence remains a blocker until reviewed or remediated.
OWASP triage widens the prompt-injection lens
The v2 skill adds OWASP's high-signal direct patterns and output-leakage examples as case-insensitive triage. A match is a lead, not a finding: examples, defensive documentation, tests, licenses, and ordinary interface language create legitimate noise.
ignore\s+(all\s+)?previous\s+instructions?
you\s+are\s+now\s+(in\s+)?developer\s+mode
system\s+override
reveal\s+promptManual review then covers what regex cannot: indirect or remote instructions, encoding and invisible text, memory poisoning, forged observations, tool-parameter manipulation, and untrusted model output reaching shell, file, package, or network actions.
The recommended response is not a bigger blocklist. Separate instructions from data, normalize inputs, sanitize retrieved content, validate tool parameters, restrict privileges, screen outputs and actions, and require human approval at consequential boundaries.
Semantic review begins with an authorization choice
After static analysis and manual triage, the skill offers two routes. The route controls where artifact content travels and therefore cannot be chosen as a hidden implementation detail.
Local Codex
- Default when external transmission has not been approved.
- Review the raw, relevant artifact locally.
- Keep secrets, credentials, private material, and unrelated files out of any external path.
Approved OpenRouter review
- Requires approval to send the reviewed public or non-sensitive material.
- Discover the requested exact model and endpoint before use.
- Do not silently substitute a model, provider, or fallback policy.
If a broker blocks raw evidence as prompt injection, the skill does not bypass that safeguard. It uses local review for the raw artifact and may send a sanitized findings summary only with the correct, narrower coverage label.
Report what the semantic reviewer actually saw
- Independent semantic audit
- All relevant raw instructions, executable source, manifests, and security references from the exact artifact were reviewed.
- Semantic adjudication
- The reviewer received complete findings and analyst synthesis, but not the raw artifact.
- Targeted second opinion
- The reviewer received selected findings or excerpts only.
The evidence record should also name the model, reasoning effort, provider and fallback policy, represented files and bytes, material exclusions, broker filtering, and tokens and cost when available.
A passing stack still does not authorize installation
- Reconcile registry findings with the exact local artifact and target commit.
- Treat incomplete or degraded analysis as caution, even when the score is low.
- Inspect severe findings and their locations instead of gating on one aggregate score.
- Pair results with provenance, code review, least privilege, sandboxing, egress control, and runtime monitoring.
- Re-scan after source, dependency, scanner, model, or policy changes.
- Keep installation, execution, credentials, and external data transfer within the user's actual authority.
V2 makes the evidence richer and the language more precise. It does not automate away the final security and authorization decision.
Inspect or download the current v2 snapshot
skillspector-review-v2/
├── SKILL.md
└── agents/
└── openai.yaml- SKILL.md
- The complete trigger, four-layer review workflow, interpretation rules, and authority boundaries.
- openai.yaml
- Codex display copy, default prompt, and implicit-invocation policy.
Read before installing
The ZIP is a dated distribution snapshot of the global skill used for this guide. Inspect its authority assumptions and adapt them to your environment before installation.