Analyze graph state and return findings.

Return the 1-based line number for a character offset in *content*.

Return a logger under the skillspector package namespace.

Context manager that applies DeepSeek compatibility patches and restores original state on exit — even if an exception occurs. Usage::

Resolve input to a scannable directory. Args: input_path: Path or URL to resolve Returns: Tuple of

Inject *broken_fn* into *module.target*, run *test_specs*, restore.

Release a slot on *key* back to the pool. Parameters ---------- key : The key previously obtained from :meth:`acq

Discover quality/policy findings via LLM analysis.

Generate SARIF, compute risk score, and set report_body from output_format. A baseline (state["baseline"]) suppresses matching findings: they nev

Compute risk score (0-100), severity band, and recommendation. Scoring uses per-rule diminishing returns: the first occurrence of a rule_id

Parse raw LLM text into :class:`Finding` objects via manual JSON. Because ``response_schema`` is ``None``, *response* is a raw string

Detect semantic intent and attack-phrasing risks using LLM analysis.

Keep only LLM-confirmed findings, enriched with explanation / remediation. Uses granular ``(file, rule_id, start_line, end_line)`` keying whe

Acquire a slot on the least-loaded available key. Scheduling priority: 1. **Recovered keys** — rate-limited keys whose backoff has e

Build one telemetry record for ``SkillspectorState['llm_call_log']``. LLM-backed nodes append a record on each run so the report can tell whether

Analyze skill for rug-pull risks (RP1–RP3).

Run an agent CLI and return the assistant response text. This is the single security-hardened entry point. All security invariants are enfor

Heuristic fallback filter for --no-llm mode. Applies rule-based filtering when LLM analysis is unavailable: 1. Drop findings with confidence

Return a fresh dict for a valid gap-fill finding. Each call returns a new copy — no shared mutable state across tests.

Clean up temporary files created during resolution.

Extract surrounding lines from *content* around the match at *match_start* (char offset).

Discover developer-intent findings via LLM analysis.

Verify that all patch targets have expected signatures / attributes. Raises :class:`RuntimeError` with a specific message if an upstream chan

Deduplicate a list of findings, returning a reduced list. Two-pass deduplication: 1. Same-file: identical (rule_id, file, matched_text) → kee

Write a minimal YARA rule file and return its path.

Execute LLM calls for all *batches* concurrently. Uses ``asyncio.gather`` with a semaphore to run up to *max_concurrency* LLM request

Return the active provider for token-budget + default-model lookups.

Run ``_analyze_dependencies`` with a mocked OSV ``query_batch``. Patches both ``query_batch`` and ``was_osv_reachable`` to return ``True`` so

Read a fixture skill directory into a file_cache dict (relative path -> content).

Return ``(api_key, base_url)`` from the active provider. Returns ``None`` when the provider's credential env var is unset, so callers can fal

Build flat ScanContext fields from state skill_path (local directory). Resolves skill_path to a directory, walks files, builds file_cache and

Detect whether a directory contains multiple independent skills. A directory is considered multi-skill when: - It has NO root-level SKILL.md

Build SARIF 2.1.0 log from findings. Filters out empty/malformed findings (missing rule_id or message) and builds the required tool.driver.ru

Detect binary files by extension or null-byte presence in the first 512 chars.

True when every field this rule specifies glob-matches *finding*.

Build the argv list for a capability-stripped ``claude -p`` call. ``-p`` / ``--print`` Non-interactive single-shot mode. The prompt is re

Estimate severity from a CVSS v3 or v4 vector string. Counts how many base metrics are at their most-severe value. This avoids adding a CVSS

Return True if a PE3 finding is a documentation reference to .env files, not actual access. SKILL.md is exempt: it is the agent's primary instruc

NB: annotate_findings reads the rule ID from the 'id' key, not 'rule_id'.

Build a minimal SkillspectorState from a fixture directory or a raw manifest. Mirrors what build_context.build_context() produces. When *man

Create one :class:`Batch` per file, splitting oversized files into chunks.

Return ``True`` when *provider* implements the :class:`AgentCLICapable` interface. Uses duck-typing rather than ``isinstance`` so that providers

Import the real (unpatched) module-level functions.

Print through Rich when available, falling back to plain text.

Re-import constants to re-run module-level config resolution.

Convert a raw ``graph.invoke()`` result into a batch-report entry. Extracts findings, manifest metadata, component metadata, and builds the c

Approximate token count from character length.

Return a stable short fingerprint for *finding*. Derived from rule id, file, line span, and message so the same finding hashes identically ac

Return a chat model for the active provider. For CLI providers (``claude_cli``, ``codex_cli``, ``gemini_cli``) this returns an :class:`AgentC

Raise :class:`RuntimeError` if *func* doesn't accept *expected_params*.

Safety-net: restore all patches regardless of depth counter.

Run YARA rules against all skill artifacts and return findings.

Warn if *url* is not a well-formed http(s) URL. Raises nothing — misconfigured URLs will still fail at the HTTP layer, but an early warning h

Return True when a finding message references a specific YARA rule.

Return True if host resolves to a private/reserved IP address.

Return an AsyncMock that returns different findings based on the file path in the prompt.

Build a minimal SkillspectorState from a fixture directory. Parses SKILL.md YAML frontmatter, builds file_cache and component_metadata. Mirro

Run only the built-in YARA rules against a single in-memory file.

Ensure *model* cannot be used as an argument injection vector. Model labels come from ``SKILLSPECTOR_MODEL`` (user-controlled) or the provide

Add a ``language_compatible`` field to each issue dict. Returns a new list — the input *issues* list is not mutated.

Query OSV.dev for vulnerabilities across a batch of packages. Args: packages: List of (name, version_or_None) tuples. ecosystem:

Apply DeepSeek compatibility patches permanently (convenience wrapper). Prefer :func:`deepseek_compat` context manager for scoped, reversible

Convert to a :class:`~skillspector.models.Finding` for the report.

Return a copy of ``os.environ`` with secret variables removed. Any variable whose name starts with a prefix in ``_SECRET_ENV_PREFIXES`` is st

Filter and enrich findings via per-file LLM calls. When ``use_llm`` is *True* and an LLM API key is configured (see ``llm_utils._resolve_llm_

Assert all 5 method references are patched (≠ originals).

Build analysis_completeness section indicating scan coverage and limitations. Helps consumers understand what was NOT analyzed and whether findin

Build the argv list for a capability-stripped ``codex exec`` call. Flags chosen (verified end-to-end against codex 0.139.0): ``exec``

Detect rate-limit errors from common LLM provider SDKs.

Return a mock run_batches that dispatches based on file_path in each batch.

Return ``(api_key, base_url)`` resolved from the environment. Tries the active SkillSpector provider first; falls back to ``OPENAI_API_KEY``

Extract the highest severity string from an OSV vulnerability object. Priority order: 1. database_specific.severity — GHSA sets this reliably

Remove ```json ... ``` wrappers from LLM output.