skillspector-rs: an optimized Rust port of the static analysis (no LLM yet)

[Dansemums]

Hi SkillSpector team and community,

I built skillspector-rs (https://github.com/Dansemums/skillspector-rs), an independent, unofficial Rust port of SkillSpector's deterministic --no-llm analysis. It is not affiliated with or endorsed by NVIDIA; the rules, rule ids and heuristics are derived from SkillSpector v2.12.0 (commit d7338f5) under Apache-2.0, with NVIDIA credited in NOTICE.

What it is

• One native binary and a Rust library, no Python, no network, no LLM.
• Ports the pattern analyzers (prompt injection, exfiltration, privilege escalation, supply chain, tool misuse, ...), YARA rules (via yara-x), Python AST checks, taint tracking, whitespace padding, and the normalized/obfuscation text views.
• Output as text, JSON or SARIF.

What is not there yet (see the README roadmap)
The LLM semantic analyzers and the meta analyzer, provider adapters, OSV lookups (SC4), transitive references, MCP registry mode, baselines, and the time budgets/ledger. A few pattern analyzers are also still missing (P5, TP1-TP3, TR2); they are listed in tests/fixtures/KNOWN_DIFFERENCES.md.

Parity
I compare (file, rule id, start line) per skill folder against SkillSpector's own --no-llm output. On a private corpus of 865 real skill folders: 2777 of 2800 findings match with 0 extra findings and 0 errors; the 23 differences are SC4 (needs the network) and a few runtime-limit coverage notes that depend on machine load. On the public fixtures in the repo: 86 of 93 reference findings match (4 extra, all from the not-yet-ported analyzers above). skillspector-rs-diff and the golden-generation scripts are in the repo so anyone can check this on their own skills.

Speed (Apple M1 Pro, 8 cores, one process per scan, cold start included; full table with p95/p99 and memory in docs/SCOREBOARD.md):

• Single skill, p50: 3.7 s (SkillSpector) vs 0.23 s (16x); p95: 4.6 s vs 0.49 s.
• Peak memory p50: about 200 MB vs 80 MB.
• 865 real skill folders in one run: about 13 s (about 65 skills/s). SkillSpector's recursive mode stops after 32 skills, so I could not time the same workload on it.

I would love feedback on parity gaps (the skillspector-rs-diff output makes them easy to report), and I am glad to adjust anything about naming or attribution if you prefer something different.