SkillSpector 2.13.3 raises scan limits, checks AI replies

NVIDIA published SkillSpector 2.13.3 on November 2, 2026, five days after 2.13.2. Both are patch releases on the 2.13 maintenance branch. 2.13.3 lets large skills finish the tool-description comparison (TP4), reports an AI review that was refused or cut off as incomplete instead of clean, and adds a batch of scan-integrity fixes and four dependency security updates.

Release facts

Check before upgrading

• Regenerate baselines. The notes say exact-fingerprint baselines are bound to a scanner version. Regenerate and review them for 2.13.3 instead of relabeling old ones.
• Longer default deadline. The workflow deadline rises to 1,080 seconds (18 minutes), set with SKILLSPECTOR_MAX_WORKFLOW_SECONDS. The TP4 batch cap defaults to 256 and is set with SKILLSPECTOR_TP4_MAX_BATCHES. CI jobs with their own timeout may need more headroom.
• Pi and OpenCode wrappers keep 120 seconds. For scans that need the longer deadline, the notes say to call the CLI directly.
• More scans may report incomplete. Refusals, truncated responses, missing fields and invalid tool results now count as incomplete inspection. A gate that only checks for SAFE can start failing on inputs that used to pass.

What changed

• TP4 limits (PR 945). Batches run in parallel within SKILLSPECTOR_MAX_LLM_CONCURRENCY, keep their result order, and stop at the new configurable caps. Other file, byte, token and provider limits are unchanged.
• AI response checks (PR 946). Responses must be finished and contain the required fields. Formatting recovery is allowed only when the values and structure are preserved.
• Report safety. Baseline and recursive report paths that would overwrite the input, or a child skill's input, are rejected, including file aliases.
• Detection. npx commands in JSON MCP configs are inspected, and more Claude, Cline and Roo Code credential and config filenames are recognized. Credential reads in urllib headers are followed to network calls. Writes to agent-memory files from auto-run tests are flagged. A lower-confidence YARA signal covers directory walking plus encryption plus binary writes.
• Coverage. PowerShell coverage returns for obfuscation and hidden-instruction checks. Pipenv dependencies are extracted and checked against locked versions. Non-English gap-fill findings now count toward batch scores instead of leaving a stale SAFE verdict.
• Dependencies. Lockfile pins move to anyio 4.14.2, certifi 2026.10.19, langgraph-sdk 0.4.4 and urllib3 2.8.0.

What 2.13.2 fixed

2.13.2 (October 28) cut false incomplete-analysis reports. Wrappers like timeout, sudo, nice and xargs in Markdown tables no longer trip the parser. sudo -n and 2>&1 parse correctly. .mjs and .cjs files are classified consistently. In its own live acceptance run, two large-skill TP4 cases failed under the old 600-second budget, which is the gap 2.13.3's limits address.

Questions

Does a clean 2.13.3 scan prove a skill is safe? No. The notes say generated helpers, archives and other commands built at run time are still not fully analysed and may report incomplete inspection.

Can I install it with pip from PyPI? The release notes say the publication workflow does not publish to PyPI. Install the wheel attached to the GitHub release.

Should I upgrade from 2.13.2? Yes if you scan large skills or rely on AI review results, since unfinished responses no longer pass silently. Budget time to regenerate baselines.

More on the SkillSpector hub and the agent infrastructure category. For blocking risky commands at run time rather than scanning skills before install, see today's Laya Guard 0.7.1.