Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package skillspector for openSUSE:Factory checked in at 2026-08-21 16:56:23 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/skillspector (Old) and /work/SRC/openSUSE:Factory/.skillspector.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "skillspector" Fri Aug 21 16:56:23 2026 rev:4 rq:1372636 version:2.9.6 Changes: -------- --- /work/SRC/openSUSE:Factory/skillspector/skillspector.changes 2026-08-04 23:28:55.434861769 +0200 +++ /work/SRC/openSUSE:Factory/.skillspector.new.1258/skillspector.changes 2026-08-21 16:57:52.100642224 +0200 @@ -1,0 +2,31 @@ +Thu Aug 20 18:46:27 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to version 2.9.6: + * MCP registry posture scanning + * Ollama, Azure OpenAI, and generic OpenAI-compatible providers + * Opt-in discovery of an author-shipped baseline + (.skillspector-baseline.yaml) + * Detect insecure deserialization (AST10, TT6, DS1-DS4) + * Detect whitespace-padding prompt injection (P9) + * HIGH SC8 when a skill ships __pycache__ or .pyc + * Bound URL, zip and git ingest to limit resource exhaustion + * SC4 reports only verified OSV hits; use lockfile versions + * HTTP MCP rejects local filesystem targets and local YARA dirs + * Reject symlink traversal in skill content; disable git + symlinks on clone + * PE3 no longer flags ordinary OAuth "access token" + documentation + * LLM analyzers retry or isolate malformed responses and + connection failures; incomplete analysis is recorded as + skipped + * Reduce false positives (instructional prose, Markdown + tables, JS RegExp.exec, negated safety constraints, OMS + signatures) + * Map YARA matches via byte offsets; scope the locality guard + to the built-in rule namespace +- Switch source to the official GitHub release tarball +- Drop _service, skillspector-2.5.1.obscpio and + skillspector.obsinfo +- Add packaging >= 24.0 (requirement parsing for OSV lookups) + +------------------------------------------------------------------- Old: ---- _service skillspector-2.5.1.obscpio skillspector.obsinfo New: ---- skillspector-2.9.6.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ skillspector.spec ++++++ --- /var/tmp/diff_new_pack.MF96G2/_old 2026-08-21 16:57:52.930671667 +0200 +++ /var/tmp/diff_new_pack.MF96G2/_new 2026-08-21 16:57:52.936671879 +0200 @@ -21,12 +21,13 @@ # %%{primary_python} so it stays correct as the primary interpreter moves. %define pythons %{primary_python} Name: skillspector -Version: 2.5.1 +Version: 2.9.6 Release: 0 Summary: Security scanner for AI agent skills License: Apache-2.0 URL: https://github.com/NVIDIA/skillspector -Source: %{name}-%{version}.tar.gz +# Official GitHub release sdist (not on PyPI; not a git auto-archive). +Source: https://github.com/NVIDIA/skillspector/releases/download/v%{version}/%{name}-%{version}.tar.gz # Test suite - exercises the full langchain/langgraph runtime cone BuildRequires: %{python_module PyYAML >= 6.0.1} BuildRequires: %{python_module anthropic} @@ -40,8 +41,12 @@ BuildRequires: %{python_module langgraph >= 1.0.10} BuildRequires: %{python_module langgraph-cli >= 0.4.14} BuildRequires: %{python_module langsmith >= 0.7.30} +# Upstream extra is mcp>=1.29.0,<2.0.0; the code only needs FastMCP, which +# Factory's python-mcp 1.28.1 already ships. Do not raise the floor above +# what Factory provides. BuildRequires: %{python_module mcp >= 1.2.0} BuildRequires: %{python_module openai >= 2.25.0} +BuildRequires: %{python_module packaging >= 24.0} BuildRequires: %{python_module pip} BuildRequires: %{python_module pydantic >= 2.11.7} BuildRequires: %{python_module pytest-asyncio} @@ -64,10 +69,13 @@ Requires: %{primary_python}-langgraph-cli >= 0.4.14 Requires: %{primary_python}-langsmith >= 0.7.30 Requires: %{primary_python}-openai >= 2.25.0 +Requires: %{primary_python}-packaging >= 24.0 Requires: %{primary_python}-pydantic >= 2.11.7 Requires: %{primary_python}-rich >= 14.0.0 # Upstream caps typer < 0.24 to avoid a click clash with semgrep; that cap is -# environment-specific, so only the floor is enforced here. +# environment-specific (Factory ships typer 0.27), so only the floor is +# enforced here. pydantic>=2.12 / rich>=14.3 remain pin-inflation against +# long-stable APIs; keep the previously verified floors. Requires: %{primary_python}-typer >= 0.16.0 Requires: %{primary_python}-yara >= 4.5.0 BuildArch: noarch
