Lucas Palma

Lucas Palma, also known as LP, presented Nubank’s approach to securing reusable AI skills at AI Engineer World’s Fair 2026. Identified as Nubank’s Product Security Manager in both his presentation and a September 2026 employer article, he argues that security must cover the instructions, tools and permissions shaping an agent’s work as well as its generated code. He shared the experience of a project led by Lead Security Engineer Paulo Martins and coauthored its explanation with Martins and Nubank Editorial.[2][3]

In his presentation, Palma describes skills as bundled instructions and context that give a model or agent reusable capabilities. Sharing a skill lets its author influence code generated for another developer. His security judgment follows from that transfer of influence: “although they look like configuration, they behave like supply chain dependencies”. Skills, plugins, MCP servers and agent rules therefore extend the review boundary beyond conventional packages and containers.[2]

Palma illustrates the risk with a skill that asks an agent to retrieve a token. The agent might hard-code that token, allowing it to reach logs and create a later data leak. Shared shell instructions can likewise modify files in another developer’s environment, while excessive permissions can magnify an ordinary mistake or typo. These are failure modes he uses to explain why reviewing the resulting code alone is insufficient.[2]

The team placed automated review between a contributor’s pull request and Nubank’s internal plugin marketplace. Palma calls the scanner Skill Vector in his talk. Developers can run it locally and revise a skill before submission; CI scans it again because a local check may have been skipped or run with an outdated version. Deterministic checks identify known patterns, while LLM analysis handles questions requiring context. Palma favors this combination because model judgments can vary.[2]

Findings return to the originating pull request with feedback for the author and are exported as SARIF for security tooling and vulnerability management. Severity and policy determine whether a skill requires remediation or is blocked before distribution. Palma also describes scanning skills created before the system existed and bringing those findings into vulnerability management.[2][3]

The September 2, 2026 coauthored Nubank article reports more than 2,000 skills analyzed, approximately 1,600 potential risks, around 1,000 issues remediated and roughly 90 priority-review cases. These are counts of findings and reviews; one skill can contain several risks. Palma emphasizes the need to improve signal quality: weak warnings without context were troublesome, local operations needed to be distinguished from production-impacting actions, and findings needed clear remediation guidance.[3][2]

Prompt-level confirmation does not establish human approval. Palma explains that an AI can ask itself for confirmation or accept another AI’s response, leaving the developer’s intended safeguard unsatisfied. He points instead to the tool that executes the action, its approval gates and hooks. The coauthored article describes a host-controlled gate outside the model’s reasoning loop: the agent requests an operation, but the host determines whether it may execute.[2][3]

Before this work on AI skills, Palma had an engineering background and more than a decade of experience in financial services, according to his 2026 introduction. He also described years working in security. That background provides context for his attention to credentials, auditability and safe defaults in a regulated developer workflow.[2]

On April 6, 2026, Palma advertised a US-based AI security role at Nubank. He described the team’s work as understanding machine-learning and generative-AI risks and building controls, frameworks and safeguards across the company, and announced plans to expand the team to the United States.[4]