NVIDIA / NVIDIA/SkillSpector

Quoted version metadata creates a false missing-file reference and changes score 0 from SAFE to CAUTION

Open Beginner friendly
#524 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
17.9k
Forks
1.5k
Avg merge
5d 10h
Merged PRs (30d)
66

Description

SkillSpector 2.11.2 treats metadata.version: "1.2" in SKILL.md frontmatter as a missing local-file reference. This marks an otherwise complete, harmless scan as partial and changes its recommendation to CAUTION despite score 0 and zero findings.

Reproduction needs no API credentials:

---
name: greeting
description: Write a friendly greeting.
metadata:
  version: "1.2"
---

# Greeting
Write a friendly greeting for the user.

Save that as version-reference-fixture/SKILL.md, then run:

skillspector scan ./version-reference-fixture --no-llm --format json --output report.json

Repeat after removing just the metadata and version lines.

Input Score Findings Recommendation Complete
No version metadata 0 0 SAFE true
metadata.version: "1.2" 0 0 CAUTION false

Both runs finish successfully with 100% component coverage. The failing variant has exactly one ledger exception: reference_resolution / reference_unresolved at SKILL.md:5. Its analysis_completeness.references entry is:

{
  "source_path": "SKILL.md",
  "line": 5,
  "column": 13,
  "evidence": "version: \"1.2\"",
  "target_path": null,
  "status": "missing",
  "disposition": "partial"
}

Expected: quoted version metadata should not be classified as a local-file dependency. The risk score and findings should remain unchanged, and this metadata alone should not make analysis partial.

This also occurs in the API Gateway skill on ClawHub. That larger skill has additional completeness exceptions, so this reproduction isolates the metadata bug rather than claiming it is the only cause of its CAUTION result.

Related: #510 concerns output-file references, and #450 / #451 concern slash-separated prose. This case is a quoted version value in YAML frontmatter.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by creating the described version-reference-fixture/SKILL.md and running the provided skillspector scan command, then inspect how YAML frontmatter values enter reference_resolution. The change is done when metadata.version: "1.2" is not recorded as reference_unresolved, while score, findings, recommendation, and analysis completeness remain unchanged; repeat the comparison without the metadata.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
74/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.