Security scanning

Skills can include instructions and executable scripts. Skills Manager gates risky content with a scan pipeline (NVIDIA SkillSpector + optional semantic checks) before submit / approve / publish.

When scanning runs

Gate	Behavior (when scanning enabled)
Submit for review	Blocks on HIGH / CRITICAL findings
Approve	Requires findings acknowledged
Publish (org / global)	Stricter — HIGH overrides typically disallowed for marketplace
Rescan	Re-run from the version’s scan panel

UI surfaces: security badge, scan panel, acknowledge / override actions (override limited by tier and policy).

Feature flags

Variable	Default (typical)	Effect
SKILL_SCAN_ENABLED	often false until ops enables	Master switch for the scan pipeline
SKILL_SEMANTIC_SCAN_ENABLED	often true	Extra LLM semantic stage (fail-soft)
SKILLSPECTOR_CMD	path to binary	Subprocess scanner
SKILL_SCAN_POLICY	optional JSON	Severity band overrides
SKILL_MARKETPLACE_ENABLED	often false on-prem	Marketplace / install / promote APIs

On-prem operators: see On-Prem for enablement. SaaS: ask your account team which flags are on for your tenant.

Preview before trust

Even with scans, treat marketplace skills as third-party content:

pm-skills preview <name>
pm-skills preview <name> --file scripts/…   # when supported

Pull only after preview (and install in the UI when required).

Provenance & local tamper

Managed SKILL.md files carry Prompt Manager metadata. pm-skills status flags modified locally when on-disk content no longer matches the lockfile hash — the failure mode governance exists to catch.