All issues

P2 "Hidden Instructions" rule produces false positives due to missing word boundary on GET

#297

· nikolay-kolarov opened

on Jul 22, 2026

[Feature] Bound the cost of an LLM scan: --max-llm-calls / --llm-token-budget, and --estimate before spending

#296

· Mark2Mac opened

on Jul 22, 2026

[BUG] claude_cli provider omits --setting-sources=, so the spawned claude runs the user's hooks (4 LLM calls -> 3h09m CPU, 1225 hook sessions)

#295

· Mark2Mac opened

on Jul 22, 2026

[BUG] requirements.txt: any version specifier is treated as an exact pin (pillow>=10.0.0 reported as pillow==10.0.0 with its CVEs)

#294

· Mark2Mac opened

on Jul 22, 2026

Deep scan can report SAFE when provider is unavailable

#290

· tuodijihua opened

on Jul 21, 2026

Auto-discover a shipped baseline so distributed skills carry their own suppressions

#278

· airadier opened

on Jul 16, 2026

Add your HVTrust badge to the README?

#277

· YugantM opened

on Jul 15, 2026

github releases + changelog

#274

· kevinmichaelchen opened

on Jul 14, 2026

Publish SkillSpector to PyPI for easier installation and integration

#271

· HarmannMann opened

on Jul 13, 2026

Security: prevent host-file disclosure and scanner verdict bypasses

#268

· fmercurio opened

on Jul 12, 2026

Single malformed LLM response aborts the entire scan (uncaught pydantic ValidationError) — triggered consistently by the default nv_build model

#250

· csgrullon opened

on Jul 4, 2026

[Security] Insecure deserialization (pickle / PHP unserialize / Ruby Marshal / JS node-serialize) not detected — an RCE-class skill scores 0/SAFE

#245

· AbhiramDwivedi opened

on Jul 3, 2026