Skip to main content
Search

# Static Analysis

2 related articles

Subscribe to updates
  1. NVIDIA/SkillSpector

    NVIDIA puts a checkpoint before agent skills install: 26.1% of 31,132 scanned skills carry vulnerabilities

    AI agent skills run on implicit trust and get little vetting before installation. NVIDIA's open-source SkillSpector scans a repository, zip file, directory or single file before install, covering 71 vulnerability patterns in 17 categories with fast static analysis and an optional LLM semantic pass. In the 31,132-skill analyzed subset of its research dataset, 26.1% of skills contain vulnerabilities and 5.2% show likely malicious intent.

    NVIDIA
    SkillSpectorAgent SkillsStatic AnalysisPrompt Injection
  2. arXiv

    Code gets caught inside the reasoning stream: a security rule fires, the model rewrites in place, and secure-and-working runs rise from under 15% to 72.8%–98.1%

    Reasoning models draft code early inside their chain of thought, and SecReason scans the streaming tokens before delivery and inserts a warning so the model repairs the draft within the same reasoning trace, raising the share of runs that are both secure and functionally correct from below 15% to 72.8%–98.1%.

    Singapore Management University
    Ruidong Han（First author）
    SecReasonIn-Stream Self-RepairVulnerability DetectionStatic AnalysisLLM code generation

You’re all caught up