Lucas Palma

Lucas Palma is a product security manager at Nubank, where he helps protect AI-assisted software development in regulated financial services. He helped build Skill Vector, a security-review system that scrutinizes AI skills before developers share them through an internal marketplace.

Palma has an engineering background and more than a decade of experience in financial services. His security responsibilities have encompassed application, mobile, platform, and AI security. In 2025, he contributed to discussions about AI safety and governance in Latin America; more recently, he described expanding Nubank’s AI security team into the United States. His product-security work has also included collaboration on Android’s Verified Financial Calls initiative, designed to counter financial impersonation scams.

• AI skills are supply-chain dependencies. Skills, plugins, MCP servers, and agent instructions can influence generated code, expose credentials, grant excessive permissions, or execute destructive commands. Palma treats them as software dependencies requiring security review before they enter engineering workflows.

• Skill Vector embeds security in development. Developers can scan skills locally; continuous integration repeats the checks and delivers findings directly in pull requests. Policies can require remediation or block distribution, while standardized reporting feeds existing vulnerability-management systems.

• Hybrid security review combines rules and context. Deterministic checks catch familiar hazards reliably, while LLM-assisted analysis evaluates instructions and behavioral risks that simple pattern matching can miss.

• Human approval belongs at the execution layer. Instructions telling an agent to request confirmation do not ensure that a person actually approves an action: another automated system might provide the confirmation. Palma favors enforceable tool-level approval gates, trusted execution paths, audit logs, and controlled marketplaces.