Repository navigation
Skillspector is flagged to contain malware #236
Description
Skillspector was flagged by our internal malware detection tools.
You can reproduce the findings by downloading the .zip package from Github (e.g. Sha 78be329 - Main branch from 28.Jun 2026) and uploading to VirusTotal, you get multiple Trojan findings, including:
- Trojan.MAC.Agent.LK
- Trojan.MAC.Agent.LK (B)
- Zip.trojan.generic
- Trojan:Script/Wacatac.B!ml
... found by 9 scanning engines.
This can be reproduced with multiple commits since at least 28.Jun
Activity
fix(yara): skip malformed unicode encoded rules (NVIDIA#236)
fix(yara): reduce packaged malware-signature false positives (#236)
Merge pull request #247 from rodboev/pr/yara-packaging-236
Merge remote-tracking branch 'upstream/main' into feat/detect-whitesp…
imashleykirk commentedon Oct 21, 2026
Still reproducible on v2.13.0: Bitdefender flags the release source archive as Trojan.MAC.Agent.LK
Following up on #236 (closed by #247 in v2.5.0). The detection is back, or was not fully resolved, in the current release.
What happened
https://codeload.github.com/NVIDIA/SkillSpector/tar.gz/refs/tags/v2.13.0What I think is going on
Same root cause as #236: the packaged YARA rules and test fixtures contain macOS-stealer signature strings (keychain access,
osascriptprompts, download-and-execute patterns), which static AV engines match. #247 reduced this, but a later release appears to have reintroduced matching content, possibly through newer rule files or fixtures.Happy to share more detail if it helps.