# We Vetted 2000 AI Skills Before They Reached Developers — Lucas Palma, Nubank

Source: [AI Engineer](https://www.youtube.com/watch?v=iKQ78wyJEXU)  
Feed7 permalink: https://feed7.dev/p/we-vetted-2000-ai-skills-before-they-reached-developers-lucas-palma-nuba-0k4ehkz  
Published: 2026-07-29T22:00:06.000Z  
Trust: Source Linked (source_linked)

## Why Included

Treat agent skills as supply-chain dependencies. Nubank scans them locally and in CI with deterministic rules plus LLM review, then gates marketplace distribution and feeds findings into vulnerability management.

## Source Summary

Nubank’s internal pipeline scanned **more than 2,000 skills** and identified **over 1,500 risks**, with more than 1,000 subsequently remediated. Checks cover unsafe instructions, destructive shell commands, credential handling, excessive permissions, data exposure, and risky MCP use.

## Practical Implication

Put a canonical marketplace behind a security gate. Let authors scan locally, rerun the current scanner in CI, combine deterministic checks with contextual LLM review, report actionable findings in the pull request, and enforce approval at the tool layer rather than in prompts.

## Agent-Ready Context

Nubank’s internal pipeline scanned **more than 2,000 skills** and identified **over 1,500 risks**, with more than 1,000 subsequently remediated. Checks cover unsafe instructions, destructive shell commands, credential handling, excessive permissions, data exposure, and risky MCP use.

Put a canonical marketplace behind a security gate. Let authors scan locally, rerun the current scanner in CI, combine deterministic checks with contextual LLM review, report actionable findings in the pull request, and enforce approval at the tool layer rather than in prompts.

Risk counts are findings, not the number of vulnerable skills, and one skill may produce several. The talk provides no false-positive rate or scanner effectiveness benchmark; it also notes that weak signals and context-dependent severity required refinement.

## Connected Context

Feed7 judgment across 297 accumulated Signals:

This turns skill governance from library hygiene into a supply-chain control: portable instructions and tool access need repeatable scanning, review, and tool-layer enforcement before distribution. It reinforces treating skills as governed product features and makes selective installation more consequential. The reported remediation volume demonstrates operational scale, while the missing false-positive and effectiveness measures limit claims about scanner quality.

- [affaan-m/ECC](https://feed7.dev/p/ecc-0438yju) — ECC’s large cross-client surface makes Nubank’s canonical marketplace, minimal permissions, and pre-install security gate concrete prerequisites for selective reuse rather than optional audits.
- [Skills are new features: Building Skill-Centric Harness — Yogendra Miraje, FactSet](https://feed7.dev/p/skills-are-new-features-building-skill-centric-harness-yogendra-miraje-f-0lp4c7o) — FactSet frames skills as versioned features requiring governance; Nubank supplies an implementation pattern for that governance through local checks, CI rescanning, actionable review findings, and tool-layer approval.
- [addyosmani/agent-skills](https://feed7.dev/p/agent-skills-0d3lx1j) — Plain-Markdown portability makes lifecycle skills easy to distribute across harnesses, while this signal shows why portability must be paired with checks for unsafe instructions, credentials, permissions, and destructive commands.
- [In Code They Act, In Proof We Trust — Erik Meijer, Leibniz Labs](https://feed7.dev/p/in-code-they-act-in-proof-we-trust-erik-meijer-leibniz-labs-1lyno2y) — Both move safety beyond prompt compliance and inspect actions before side effects; Nubank reports a deployed scanning and approval pipeline, whereas machine-checkable safety proofs remain a proposed stronger execution gate.

## Context Map

- Layer: agent
- Domains: coding, security
- Topics: skills, harness-engineering, mcp

## Uncertainty

- Risk counts are findings, not the number of vulnerable skills, and one skill may produce several. The talk provides no false-positive rate or scanner effectiveness benchmark; it also notes that weak signals and context-dependent severity required refinement.

## Agent Instruction

Use this item as source-backed context. Do not invent claims beyond the linked source. If this item conflicts with another source, call out the conflict.