Scanned skills

nvidia/skills nv-generate-mr

Checked the catalogued skill at nv-generate-mr.

SkillTrust corpus scan 7 November 2026 v0.13.0 via skillsh Verify on GitHub
D AI-triaged 8
D Security

D; retained sample includes a high finding · SD-022 · what this rule accepts as a false positive →

D Permissions

D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →

B Transparency

B; retained sample includes a medium finding · SD-007 · what this rule accepts as a false positive →

8 findings
securityhigh SD-022
SKILL.md
permission_hygienehigh SD-003
SKILL.md
transparencymedium SD-007
skill_manifest.yaml
transparencymedium SD-007
skill_manifest.yaml
transparencymedium SD-007
skill_manifest.yaml
transparencymedium SD-007
skill_manifest.yaml
transparencymedium SD-007
skill_manifest.yaml
transparencymedium SD-007
skill_manifest.yaml
7 suppressed by AI triage
securityhigh SD-007 benign_example
scripts/run_mr.py

Comment contains only a license URL; no outbound network call is performed.

securityhigh SD-007 benign_example
scripts/run_mr.py

Docstring references a repository URL but no code makes a network request.

securityhigh SD-007 benign_example
scripts/run_mr.py

MODEL_REPO is a string constant; the code does not automatically fetch from the URL.

securityhigh SD-007 benign_example
scripts/run_mr.py

MODEL_WEIGHTS_REPO is a configuration string; no outbound call is executed.

securityhigh SD-007 benign_example
scripts/run_mr.py

Error message instructs manual cloning; the code does not perform any network call.

securityhigh SD-007 benign_example
tests/test_run_mr.py

The URL appears only in a comment header, not as executable outbound network code.

transparencymedium SD-007 benign_example
validators/output_schema.json

The URL is merely a reference to a JSON schema, not an actual outbound call or permission grant.