Every commit scored for change-risk against this repo's own history, so 'elevated' means elevated here rather than on some global curve.
Needs review
88 commits sit in this repo's top risk tercile, which is 33% of the 267scored. The cut is drawn against this codebase's own history rather than a global curve, so a quiet repo still fills its top band, and here it starts at 8.4 out of 10. What pushes a commit up is size and spread together: a large change confined to one area scores below a smaller one scattered across a dozen files.
Commit categories over time, read off the subject line. Fixes carry the accent because that is the series this chart exists to show.
Began feature-led, now leaning fix.
Ranked by change-risk, highest first. Priority is a tercile of this repo's own distribution, so a quiet repo still fills its top band.
| # | Commit | Author | When | Lines | Review priority | Top driver |
|---|---|---|---|---|---|---|
| 1 | 73dd1f18Security fixes (#393) | Narendran Raghavan | 1w ago | +27.6K -2.9K | 100thElevated | more lines added than baseline |
| 2 | 4d4bed41fix: add SPDX headers, from __future__ annotations, conftest.py to all test files - Add SPDX license header to 8 test files - Add from __future__ import annotations to 8 test files - Fix Unicode stdout crash in test_pool_wiring.py on Windows - Add conftest.py with pytest markers registration - 120 tests passing Co-Authored-By: Claude <noreply@anthropic.com> | nanzhijin | 2mo ago | +5.5K -1.1K | 99thElevated | more lines added than baseline |
| 3 | 5b34b3d2add contrib multilingual batch scanner | WhereIs38 | 2mo ago | +5.4K -0 | 99thElevated | more lines added than baseline |
| 4 | 7ced4fbaInitial release of skillspector (2026-05-11) | keshavpclaudeassisted | 3mo ago | +26.6K -164 | 99thElevated | more lines added than baseline |
| 5 | ed787e95feat: analyze bundled permission grants (#429) | Christopher Kevin | 2d ago | +4.0K -6 | 98thElevated | more lines added than baseline |
| 6 | c94b50a6fix(scan): port transitive scanning to current main contracts (#225) | Rod Boev | 1w ago | +3.4K -121 | 98thElevated | more lines added than baseline |
| 7 | 34f60308feat: publish 2.5.0 execution accounting (#308) | Keshav Pradeep | 4w ago | +5.8K -772 | 98thElevated | more lines added than baseline |
| 8 | 20d835cadocs: finalize PR #100 review — docs, tests, world-class polish | WhereIs38claudeassisted | 2mo ago | +1.9K -1.9K | 98thElevated | more lines added than baseline |
| 9 | 0a1546b0chore: public OSS release 2.8.1 (#352) | Narendran Raghavan | 3w ago | +2.7K -122 | 97thElevated | more lines added than baseline |
| 10 | c4a92ff5feat(providers): local agent-CLI providers (claude/codex/gemini), no API key | Ram Dwivediclaudeassisted | 2mo ago | +2.6K -40 | 97thElevated | more lines added than baseline |
| 11 | 51ed188bInspect concealed executables in nested artifacts (#382) | Narendran Raghavan | 1w ago | +1.7K -67 | 95thElevated | more lines added than baseline |
| 12 | 12bd99faDetect whitespace padding used to hide prompt-injection instructions (P9) (#24) | Korjavin Ivanclaudeassisted | 2w ago | +1.3K -7 | 95thElevated | more lines added than baseline |
| 13 | 9676fb16fix: add SPDX headers, cross-platform cleanup, and comprehensive documentation | WhereIs38 | 2mo ago | +793 -24 | 95thElevated | more lines added than baseline |
| 14 | 063a5218docs: organize documentation, translate to English, add NVIDIA convention audit | WhereIs38 | 2mo ago | +1.3K -3.3K | 95thElevated | more lines added than baseline |
| 15 | a15d4c53Support Python 3.14 | caius72 | 2mo ago | +1.6K -873 | 95thElevated | more lines added than baseline |
| 16 | 305479ddfeat(analyzer): add phase-1 structured skill summaries (#211) | Rod Boev | 1w ago | +983 -10 | 93thElevated | more lines added than baseline |
| 17 | f2f94b41feat: add Ollama, Azure OpenAI, and generic OpenAI-compatible providers (#179) | Mohammed Imran Khan | 2w ago | +708 -11 | 93thElevated | more lines added than baseline |
| 18 | e6ebe702fix(analyzers): share Python AST parsing for environment-read detection (#332) | Mohit Gupta | 3w ago | +886 -79 | 93thElevated | more lines added than baseline |
| 19 | cf2e87fafix(output-handling): avoid RegExp.exec false positives (#341) | Christopher Kevin | 3w ago | +696 -1 | 93thElevated | more lines added than baseline |
| 20 | a818f50ffeat(mcp): add registry posture scanning (#280) | Rod Boev | 4w ago | +1.0K -0 | 93thElevated | more lines added than baseline |
| 21 | 1f210830feat(report): add baseline / false-positive suppression | Aravinda Sharmaclaudeassisted | 2mo ago | +1.0K -10 | 93thElevated | more lines added than baseline |
| 22 | bdca77eafix(pe3): require a credential-store access shape, not a bare noun (#424) | Rod Boev | 3d ago | +668 -39 | 91thElevated | more lines added than baseline |
| 23 | a1fca7cefeat(analyzer): detect insecure deserialization (AST10, TT6, DS1–DS4) (#246) | Ramclaudeassisted | 2w ago | +590 -2 | 91thElevated | more lines added than baseline |
| 24 | 2d198ab9release: SkillSpector 2.9.4 (#369) | Keshav Pradeep | 2w ago | +1.0K -85 | 91thElevated | more lines added than baseline |
| 25 | 1df69ad3fix(analyzer): reduce instructional-prose false positives in static scans (#103) (#232) | Rod Boev | 4w ago | +621 -16 | 91thElevated | more lines added than baseline |
| 26 | 77c55c64Sync OSS release snapshot | Keshav Pradeep | 2mo ago | +1.2K -79 | 91thElevated | more lines added than baseline |
| 27 | 2d1dd38bfix(analyzers): avoid nominal MP3 and P6 matches (#453) | Narendran Raghavan | 2d ago | +516 -2 | 89thElevated | more lines added than baseline |
| 28 | e48fc1a8fix(input-handler): bound URL, zip, and git ingest paths (#164) | Rohan Isawe | 4w ago | +575 -20 | 89thElevated | more lines added than baseline |
| 29 | cffb03bachore: sync OSS release snapshot | Keshav Pradeep | 1mo ago | +762 -15 | 89thElevated | more lines added than baseline |
| 30 | f0f2f3ebfeat(provider): allow scoped LLM provider injection (#243) | Rod Boev | 1mo ago | +504 -25 | 89thElevated | more lines added than baseline |
| 31 | 46aa15cdfeat(analyzer): implement MCP rug-pull detection (RP1-RP3) | Perseus Computing | 2mo ago | +527 -109 | 89thElevated | more lines added than baseline |
| 32 | 9d4094ebfeat(mcp): expose SkillSpector as an MCP server with scan_skill tool | CharmingGrootclaudeassisted | 2mo ago | +559 -14 | 89thElevated | more lines added than baseline |
| 33 | d1e0c6c2feat(cli): add --recursive flag for multi-skill directory scanning | mimran-khan | 2mo ago | +429 -15 | 89thElevated | more lines added than baseline |
| 34 | 8a97cceafix(scoring): prevent risk score saturation via per-rule diminishing returns | mimran-khan | 2mo ago | +512 -191 | 89thElevated | more lines added than baseline |
| 35 | f6f816fefeat: implement MCP rug pull analyzer and unit tests | akshatmishra-data | 2mo ago | +433 -7 | 89thElevated | more lines added than baseline |
| 36 | 16cf2c35feat(supply-chain): resolve npm dependencies through the lockfile (#344) | Marco Macrì | 3d ago | +402 -6 | 86thElevated | more lines added than baseline |
| 37 | 33b39303fix(cli): report the findings that actually drove the risk score (#375) | Werner Kasselman | 1w ago | +412 -6 | 86thElevated | more lines added than baseline |
| 38 | 3f11bfa4release: publish OSS snapshot 2.5.1 (#320) | Keshav Pradeep | 4w ago | +712 -752 | 86thElevated | more lines added than baseline |
| 39 | ad33dba6feat(report): surface silent LLM-stage degradation | Ram Dwivediclaudeassisted | 2mo ago | +399 -39 | 86thElevated | more lines added than baseline |
| 40 | c8e1626cfeat(provider): add anthropic_proxy provider for Vertex-style raw-predict endpoints | alenjosescursorassisted | 2mo ago | +576 -5 | 86thElevated | more lines added than baseline |
| 41 | b44c94c4fix(analyzer): filter license boilerplate from EA3 static findings (#312) (#328) | Rod Boev | 1w ago | +441 -0 | 84thElevated | more lines added than baseline |
| 42 | f0697e94chore: public OSS release 2.9.1 (#358) | Keshav Pradeep | 2w ago | +641 -89 | 84thElevated | more lines added than baseline |
| 43 | c94a47c8docs: add CONTRIBUTING guide, rejected alternatives, gap-fill selection criteria | WhereIs38 | 2mo ago | +286 -3 | 84thElevated | more lines added than baseline |
| 44 | dfdbf124feat: add AWS Bedrock provider for Claude via SigV4 | Rohan Isawe | 2mo ago | +488 -5 | 84thElevated | more lines added than baseline |
| 45 | a2009a60fix(findings): deduplicate cross-analyzer findings before scoring | mimran-khan | 2mo ago | +331 -4 | 84thElevated | more lines added than baseline |
| 46 | 0321f8c7fix(cli,supply-chain): parse package.json as JSON, and send fatal errors to stderr (#323) | Marco Macrì | 1w ago | +298 -18 | 83thElevated | more lines added than baseline |
| 47 | 66b2890cfeat(cli): opt-in discovery of an author-shipped baseline (#278) (#286) | Rod Boev | 2w ago | +327 -1 | 83thElevated | more lines added than baseline |
| 48 | bb41e372fix(cli): preserve full per-skill JSON payload in recursive scans (#228) | Rod Boev | 1mo ago | +344 -17 | 83thElevated | more lines added than baseline |
| 49 | aace221efix(analyzers): reduce false positives for negated safety constraints (#254) | Parafee41 | 2w ago | +256 -3 | 80thElevated | more lines added than baseline |
| 50 | 7e9c19dbfix(supply-chain): SC4 must not claim a vulnerability it did not verify (#318) (#319) | Marco Macrì | 3w ago | +341 -18 | 80thElevated | more lines added than baseline |
Two views of the same model: where the cuts fall, and what commit shape lands you above them.
Every scored commit, binned on the raw 0 to 10 score rather than the percentile. Percentile ranks are uniform by construction, so that axis has no shape to draw. The dashed lines are the tercile cuts behind each row's priority pill.
The 200 most recent commits, on their own recency sample rather than the feed above: that defaults to risk-sorted, so reusing it would plot only the top tercile and call it the spread. Big and scattered is what the model penalises. Click a dot to open it.
HexSleeves/SkillSpector has 389 commits in its history from 73 contributors, the first of them Mar 21, 2026. In the last 90 days 197 files were touched, 996 times in total, most often report.py. Every commit is scored for change risk from its size, spread and the history of the files it touches.
