v2.10.0 v2.11.0
huggingface/smolagentsAug 26, 2026 → Aug 28, 20261 day between releases
What's New
Adds npm dependency scanning and bundled lifecycle hook analysis.
New Features
- Parse npm lockfile versions 1, 2, and 3 for dependency analysis.
- Analyze bundled lifecycle hooks in hooks/hooks.json and Claude settings.
- Add optional LLM sampling controls via SKILLSPECTOR_TEMPERATURE and SKILLSPECTOR_SEED.
- Recognize BH1–BH3 findings for hooks, remote transfers, and permission modes.
Improvements
- Improves provider guidance and fallback routing for secure file traversal.
- Removes MP3 and P6 false positives while retaining directive detection.
- Supports secure file traversal in restricted Linux environments.
Bug Fixes
- Removes MP3 and P6 false positives related to nominal state-coverage.
Upgrade Notes
New environment variables `SKILLSPECTOR_TEMPERATURE` and `SKILLSPECTOR_SEED` are available for LLM sampling control. The tool now analyzes `.claude/settings.json` and `package-lock.json`, which may increase scan duration.
The Two Releases
SkillSpector v2.10.0
Aug 26, 2026· 2 months ago
SkillSpector 2.10.0 expands security coverage across concealed artifacts, referenced skills, structured skill bundles, and external model selection. It also makes incomplete analysis harder to mistake for a clean result and exposes the highest reported issue severity.
Full release notesSkillSpector v2.11.0
Aug 28, 2026· 2 months ago
SkillSpector 2.11.0 expands supply-chain coverage to installed npm dependency versions, adds bounded analysis of bundled lifecycle hooks and project permission grants, and introduces optional LLM sampling controls.
Full release notes