https://video.ut0pia.org/videos/watch/b583fce0-a191-4998-aa17-a77d2e2b5d9e An AI skill is a piece of code you hand a model to extend what it can do, and once engineers start sharing skills with each other, each one becomes a supply chain risk, more so inside a regulated bank. Lucas Palma's security team at Nubank built Skill Vector to sit between a skill and the internal marketplace, so nothing reaches developers unvetted. Every skill is scanned first with deterministic checks, for destructive shell commands and the like, then with an LLM for the context those checks miss, and only then does it get a decision and permissions scoped to who will use it. Running that gate over more than 2,000 skills surfaced real problems, since a single skill can carry many, and fed them into the bank's vulnerability management program with approval gates and human confirmation. What worked was pairing deterministic scans with LLM review; what needed work was the guidance the system gave and the habit of running skills locally before vetting. The lesson he leaves is simple: treat skills like any other dependency, and only what clears the gate belongs in the marketplace. Speaker info: https://www.linkedin.com/in/lucaspalma/, Timestamps: 0:00 - Introduction: making code safe at a bank 1:32 - AI skills as a supply chain risk 2:50 - What counts as an AI skill 3:57 - The extra weight of a regulated environment 6:07 - From plugins to a vetted marketplace 6:58 - What Skill Vector does 7:37 - Deterministic checks, then the LLM 10:00 - Scanning over two thousand skills 11:22 - What worked and what needed improvement 13:30 - Approval gates and human confirmation 14:23 - Next steps and policies Thu, 30 Jul 2026 17:23:45 GMT https://validator.w3.org/feed/docs/rss2.html PeerTube - https://video.ut0pia.org https://video.ut0pia.org/lazy-static/avatars/0287a09a-aae7-4840-9843-b416426e7046.webp https://video.ut0pia.org/videos/watch/b583fce0-a191-4998-aa17-a77d2e2b5d9e All rights reserved, unless otherwise specified in the terms specified at https://video.ut0pia.org/about and potential licenses granted by each content's rightholder.