Building an Advanced AI Skill Security Auditing Pipeline with NVIDIA SkillSpector, LangGraph, YARA Rules, SARIF, and CI Policy Gates
In this tutorial, we build a workflow for evaluating the security posture of AI skills with NVIDIA SkillSpector. We create a synthetic skill marketplace containing clean, risky, malicious, and MCP-based examples, then scan each skill through SkillSpector’s LangGraph inspection pipeline. We examine risk scores, categorized findings, confidence levels, analyzer completeness, and executable-script indicators before organizing the results into portfolio-level DataFrames. We also generate SARIF and
Get smart on it
This tutorial describes how to build a security auditing system for AI skills using NVIDIA SkillSpector and related tools. The workflow involves creating a collection of AI skills with varying security postures, scanning them through an inspection pipeline, and generating reports that identify risks and security issues. The system uses multiple tools to detect problems, establish security baselines, create custom detection rules, and enforce security requirements before skills are deployed.
Related news
Meet Shepherd: An Open-Source Python Substrate That Lets Meta-Agents Fork, Replay, and Revert Any Agent Run
Long-running agents accumulate state that no transcript captures. A coding agent at step 10 holds edited files, a running dev server, installed packages, and a warm prompt cache. When it misreads a traceback and rewrites a file that was already correct, neither available recovery path is cheap: patching forward grows the context and the token bill, and restarting from step one re-pays every model and tool call while reproducing nothing exactly, because runs are non-deterministic. Jumping back t
How to Disable Gemini in Gmail and Google Docs
New AI toolbars and prompts are showing up in Google Docs and Gmail. If you don’t want Gemini’s help in writing documents and emails, here’s how to turn that stuff off.
