--- schema: 1 type: video title: 'We Vetted 2000 AI Skills Before They Reached Developers — Lucas Palma, Nubank' description: >- An AI skill is a piece of code you hand a model to extend what it can do, and once engineers start sharing skills with each other, each one becomes a supply chain risk, more so inside a regulated bank. Lucas Palma's security team at Nubank built Skill Vector to sit between a skill and the internal marketplace, so nothing reaches developers unvetted. Every skill is scanned first with deterministic checks, for destructive shell commands and the like, then with an LLM for the context those checks miss, and only then does it get a decision and permissions scoped to who will use it. Running that gate over more than 2,000 skills surfaced real problems, since a single skill can carry many, and fed them into the bank's vulnerability management program with approval gates and human confirmation. What worked was pairing deterministic scans with LLM review; what needed work was the guidance the system gave and the habit of running skills locally before vetting. The lesson he leaves is simple: treat skills like any other dependency, and only what clears the gate belongs in the marketplace. Speaker info: - https://www.linkedin.com/in/lucaspalma/ Timestamps: 0:00 - Introduction: making code safe at a bank 1:32 - AI skills as a supply chain risk 2:50 - What counts as an AI skill 3:57 - The extra weight of a regulated environment 6:07 - From plugins to a vetted marketplace 6:58 - What Skill Vector does 7:37 - Deterministic checks, then the LLM 10:00 - Scanning over two thousand skills 11:22 - What worked and what needed improvement 13:30 - Approval gates and human confirmation 14:23 - Next steps and policies canonical: >- https://liquidgold.cc/channel/aidotengineer/explore/video/we-vetted-2000-ai-skills-before-they-reached-develo-c21041c90225 markdown: >- https://liquidgold.cc/channel/aidotengineer/video/we-vetted-2000-ai-skills-before-they-reached-develo-c21041c90225.md llms: null parent: 'https://liquidgold.cc/channel/aidotengineer.md' channel: aidotengineer updated: '2026-10-24T06:29:44.144Z' language: null children: [] videoId: iKQ78wyJEXU durationSeconds: 984 publishedAt: '2026-07-29T22:00:06.000Z' searchChunks: - ordinal: 0 text: null startSeconds: 95 endSeconds: 105 watch: 'https://liquidgold.cc/watch/iKQ78wyJEXU?t=95' heldReason: rights - ordinal: 1 text: null startSeconds: 105 endSeconds: 177 watch: 'https://liquidgold.cc/watch/iKQ78wyJEXU?t=105' heldReason: rights - ordinal: 2 text: null startSeconds: 189 endSeconds: 244 watch: 'https://liquidgold.cc/watch/iKQ78wyJEXU?t=189' heldReason: rights - ordinal: 3 text: null startSeconds: 244 endSeconds: 257 watch: 'https://liquidgold.cc/watch/iKQ78wyJEXU?t=244' heldReason: rights - ordinal: 4 text: null startSeconds: 257 endSeconds: 374 watch: 'https://liquidgold.cc/watch/iKQ78wyJEXU?t=257' heldReason: rights - ordinal: 5 text: null startSeconds: 257 endSeconds: 374 watch: 'https://liquidgold.cc/watch/iKQ78wyJEXU?t=257' heldReason: rights - ordinal: 6 text: null startSeconds: 384 endSeconds: 418 watch: 'https://liquidgold.cc/watch/iKQ78wyJEXU?t=384' heldReason: rights - ordinal: 7 text: null startSeconds: 430 endSeconds: 464 watch: 'https://liquidgold.cc/watch/iKQ78wyJEXU?t=430' heldReason: rights - ordinal: 8 text: null startSeconds: 464 endSeconds: 476 watch: 'https://liquidgold.cc/watch/iKQ78wyJEXU?t=464' heldReason: rights - ordinal: 9 text: null startSeconds: 476 endSeconds: 608 watch: 'https://liquidgold.cc/watch/iKQ78wyJEXU?t=476' heldReason: rights - ordinal: 10 text: null startSeconds: 476 endSeconds: 608 watch: 'https://liquidgold.cc/watch/iKQ78wyJEXU?t=476' heldReason: rights - ordinal: 11 text: null startSeconds: 608 endSeconds: 621 watch: 'https://liquidgold.cc/watch/iKQ78wyJEXU?t=608' heldReason: rights - ordinal: 12 text: null startSeconds: 688 endSeconds: 699 watch: 'https://liquidgold.cc/watch/iKQ78wyJEXU?t=688' heldReason: rights - ordinal: 13 text: null startSeconds: 699 endSeconds: 814 watch: 'https://liquidgold.cc/watch/iKQ78wyJEXU?t=699' heldReason: rights - ordinal: 14 text: null startSeconds: 814 endSeconds: 827 watch: 'https://liquidgold.cc/watch/iKQ78wyJEXU?t=814' heldReason: rights - ordinal: 15 text: null startSeconds: 827 endSeconds: 872 watch: 'https://liquidgold.cc/watch/iKQ78wyJEXU?t=827' heldReason: rights - ordinal: 16 text: null startSeconds: 883 endSeconds: 984 watch: 'https://liquidgold.cc/watch/iKQ78wyJEXU?t=883' heldReason: rights --- # We Vetted 2000 AI Skills Before They Reached Developers — Lucas Palma, Nubank An AI skill is a piece of code you hand a model to extend what it can do, and once engineers start sharing skills with each other, each one becomes a supply chain risk, more so inside a regulated bank. Lucas Palma's security team at Nubank built Skill Vector to sit between a skill and the internal marketplace, so nothing reaches developers unvetted. Every skill is scanned first with deterministic checks, for destructive shell commands and the like, then with an LLM for the context those checks miss, and only then does it get a decision and permissions scoped to who will use it. Running that gate over more than 2,000 skills surfaced real problems, since a single skill can carry many, and fed them into the bank's vulnerability management program with approval gates and human confirmation. What worked was pairing deterministic scans with LLM review; what needed work was the guidance the system gave and the habit of running skills locally before vetting. The lesson he leaves is simple: treat skills like any other dependency, and only what clears the gate belongs in the marketplace. Speaker info: - https://www.linkedin.com/in/lucaspalma/ Timestamps: 0:00 - Introduction: making code safe at a bank 1:32 - AI skills as a supply chain risk 2:50 - What counts as an AI skill 3:57 - The extra weight of a regulated environment 6:07 - From plugins to a vetted marketplace 6:58 - What Skill Vector does 7:37 - Deterministic checks, then the LLM 10:00 - Scanning over two thousand skills 11:22 - What worked and what needed improvement 13:30 - Approval gates and human confirmation 14:23 - Next steps and policies Canonical: https://liquidgold.cc/channel/aidotengineer/explore/video/we-vetted-2000-ai-skills-before-they-reached-develo-c21041c90225 · Channel: [AI Engineer](https://liquidgold.cc/channel/aidotengineer.md) > Search chunk text is held until public-source provenance is verified. ## Document chunks > Missing: no stored document chunks are available.