A security scan that silently omits one package cannot certify a complete dependency inventory. The reporter compares otherwise identical manifests and shows the first dependency absent from supply-chain checks because the parser sees the BOM as part of its name. This is distinct from translation-related prompt-injection detection: it is an input-coverage…
Inspect the ClaimsCase · DiggingBeagle record
SkillSpector could silently skip the first dependency of a UTF-8 BOM requirements file
A manifest encoding variation reportedly removed the first dependency from the scanner inventory without warning.
Scope
Only the cited local tests and proposed fix are established; other manifest formats and deployed prevalence were not measured.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade D
- AI role
- AGAINST AI
Basis and provenance
The pinned Claim and its primary disclosure support the described controlled result, but do not establish a population-wide rate or calibrated impact. The only available supporting evidence is the reporter's or advisory author's own account; independent reproduction has not been shown. Impact remains unbanded because no calibrated impact rubric for this particular evidence is established.
Assessed Nov 2, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV02-SKILLSPECTOR-BOM-MANIFEST-A · NVIDIA SkillSpector issue 962: requirements.txt UTF-8 BOM coverage
At a glance
Missing input must be visible as incomplete coverage; a clean findings report is not proof that the scanner read every manifest entry.
Read the implicationsOnly the cited local tests and proposed fix are established; other manifest formats and deployed prevalence were not measured. The issue does not establish whether a fixed release is shipped or how prevalent BOM-prefixed manifests are in actual submitted skill packages.
Limits and uncertaintyFull account
A security scan that silently omits one package cannot certify a complete dependency inventory. The reporter compares otherwise identical manifests and shows the first dependency absent from supply-chain checks because the parser sees the BOM as part of its name. This is distinct from translation-related prompt-injection detection: it is an input-coverage and reporting defect in a component inventory. The issue describes a proposed targeted parser repair, not a verified deployment compromise.
The first dependency line is skipped because a UTF-8 byte-order mark survives decoding and reaches the requirement parser as an unexpected character. In the issue's single-package fixture, the same jinja2==2.4.1 entry produced zero supply-chain findings with a BOM and one without; the displayed risk score changed from 8 to 20. The vulnerability here is not a hidden malicious model but false completeness of an agent-skill security scan. A robust scanner must report how many manifest entries were parsed, rejected or not inspected, not only its findings score.
Mechanism and trust boundary
- 01
Supply a BOM-prefixed dependency manifest
The first requirements line contains a leading UTF-8 BOM.
Boundary: Manifest bytes into dependency parser
- 02
Skip the first entry
A parse failure removes one package from scan results without an explicit coverage failure.
Boundary: Input parsing into asserted scan completeness
Claims & evidence
CLM-2026-NOV02-SKILLSPECTOR-BOM-MANIFEST-AThe issue documents a requirements.txt with a UTF-8 BOM whose first package entry is skipped by the scanner, changing the findings versus the same file without the BOM.supported
Basis: reported finding
- supportsNVIDIA SkillSpector issue 962: requirements.txt UTF-8 BOM coverageprimary disclosure
Issue 962, BOM and non-BOM reproduction, SC4/OSV findings
CLM-2026-NOV02-SKILLSPECTOR-BOM-MANIFEST-BIn the reporter's paired BOM reproduction, the first jinja2 requirement went uninspected and the reported risk score changed from 8 with the BOM to 20 without it.supported
Basis: reported finding
- supportsNVIDIA SkillSpector issue 962: requirements.txt UTF-8 BOM coverageprimary disclosure
Issue 962, Reproduction table and Root Cause
Implications
Missing input must be visible as incomplete coverage; a clean findings report is not proof that the scanner read every manifest entry.
Controls and mitigations
- Strip only the BOM at the beginning of an input file, report parse failures and compare enumerated dependencies against original lines.
- Run byte-for-byte manifest inventory tests for BOM and malformed lines; make any dropped dependency a visible coverage failure.
Unknowns and contradictions
- Only the cited local tests and proposed fix are established; other manifest formats and deployed prevalence were not measured.
- The issue does not establish whether a fixed release is shipped or how prevalent BOM-prefixed manifests are in actual submitted skill packages.
Sources and citation
Material revision history
- Nov 2, 2026 · Canonical change recorded · new in release · revision 214