We Vetted 2000 AI Skills Before They Reached Developers — Lucas Palma, Nubank
Lucas Palma details how Nubank addressed AI skills—which function like supply chain dependencies—being a significant security risk in a regulated financial environment. To mitigate this, they built 'Skill Vector,' a comprehensive security review system that sits between the skill and the internal marketplace. This system vets every skill using a hybrid approach: deterministic checks (e.g., regex for unsafe instructions) followed by LLM analysis to assess context and behavior before granting permissions or allowing deployment.
Key takeaways
-
Treat AI Skills as Dependencies
AI skills must be treated like any other software dependency, requiring rigorous vetting and security gates, rather than just configuration files.
-
Hybrid Security Scanning is Essential
12:17
The most effective approach combines deterministic checks (for easy risks) with LLM review (for contextual behavior analysis), ensuring comprehensive coverage.
-
Security Gates Must Be Comprehensive
Vetting must cover the entire workflow, including local developer testing, CI/CD steps, PR feedback, and integration into a formal vulnerability management program.