Validate URL host against allowlist and SSRF protections. Returns the hostname on success, raises ValueError on blocked URLs.

Flatten per-batch results into a single :class:`Finding` list. Intended for discovery-mode analyzers where :meth:`parse_response` ret

Create the active provider's native LangChain chat model. CLI providers (``claude_cli``, ``codex_cli``, ``gemini_cli``) do not have a native

Return True when the context appears to be a code example or documentation snippet.

Return ``True`` when *rule_id* is reliable for *detected_language*. Code-level rules are always compatible. Semantic rules are always compat

Return a JSON-serializable dict representation (full finding shape).

Validate that data has the minimal SARIF 2.1.0 structure. Raises ValidationError if invalid.

Clone a Git repository to a temporary directory.

Download a file from URL to a temporary directory.

Format manifest dict into a readable string for the prompt.

Create a transport and capture the rewritten request. Returns the rewritten httpx.Request and the decoded body.

Extract assistant text from ``codex exec --json`` JSONL output. Verified against codex 0.139.0, whose final message arrives nested:: {"t

Build the LLM prompt for a single batch. The default wraps :attr:`base_prompt` with line-numbered file content so the LLM can referen

Request a single chat completion and return the assistant content. Routes through :func:`get_chat_model`, which dispatches to the CLI adapter

Split *content* into line-range chunks that each fit within *max_tokens*. Returns a list of ``(chunk_text, start_line, end_line)`` tuples where l

Build an :class:`ApiKeyPool` from environment variables. Reads ``SKILLSPECTOR_API_KEYS`` — a newline- or semicolon-delimited list of ``key|ba

Return whether the analyzer can run in current environment.

Return ``(available, error_message)`` describing LLM availability. For CLI providers (``claude_cli``, ``codex_cli``, ``gemini_cli``) the check

Prefix each line with its 1-indexed line number (e.g. ``L1:``, ``L2:``). For chunks, *start_line* offsets the numbering so the LLM sees real file

Split *findings* into (kept, suppressed) using *baseline*. With no baseline, everything is kept. Suppressed findings never count toward the r

Return the suppression reason for *finding*, or None if not suppressed.

Build a dotted name string from a Name or Attribute node. Examples: ``ast.Name(id='exec')`` → ``'exec'``, ``ast.Attribute(value=Name('os'), a

Run one or more pattern modules over state components/file_cache. For each path in state["components"], loads content from state["file_cache

Replace the LLM chat-model factory with a pooled version. When *pool* is set, every call to :func:`skillspector.llm_utils.get_chat_model` ret

Strip ANSI escape sequences and disallowed control chars (keep tab/newline).

Extract a single JSON object from a CLI model's text response. Tolerates markdown code fences and surrounding prose. Raises ``ValueError`` (f

Extract a zip file to a temporary directory with path traversal protection.

Format findings for the per-file prompt (no per-finding truncation).

Extract YAML frontmatter from SKILL.md as a manifest dict.

Return the assistant text from ``claude -p --output-format text`` stdout. With ``--output-format text`` the claude CLI writes only the response t

Promote rate-limited keys whose backoff has expired.

Fix common LLM output quirks that break downstream consumers.

Convert an AnalyzerFinding (from any analyzer) to graph-state Finding.

Create and compile Skillspector workflow graph.

Return findings whose ``start_line`` falls within [start_line, end_line].

Output token budget for *model*. Uses the smaller of the percentage-based budget and any explicit ``max_output_tokens`` cap exposed by the pr

Load a baseline file (YAML or JSON) into a :class:`Baseline`. Raises FileNotFoundError if *path* is missing, ValueError if it is malformed.

Parse the LLM response for a single batch. The default converts each :class:`LLMFinding` to a :class:`Finding` via :meth:`LLMFinding.

Resolve input to a scannable directory. - If state has non-empty input_path: resolve it (Git URL, file URL, zip, file, or directory) a

Invoke the SkillSpector graph and return a structured verdict. Args: target: Git URL, file URL, ``.zip``, ``.md`` file, or local director

Return *results* sorted by risk score descending.

Assert all 5 method references are restored (== originals).

Return 1-based line number for character position *pos*.

Safety-net: restore all patches regardless of depth counter state. Call in tearDown / tearDownClass to prevent test-order leakage when random

Return the ``anthropic_version`` value from env or the default.

Get or create a temporary directory for this session.

Run the report node in JSON mode and return the metadata block.

Strip and lowercase all strings in the list. Returns sorted list of unique values.

Drive *proc* to completion with memory and time bounds. Feeds *prompt_bytes* to stdin and drains stdout/stderr concurrently (so a large promp

Construct the active provider based on ``SKILLSPECTOR_PROVIDER``.

Rewrite a resolved call name to its fully-qualified form using import aliases. Bridges several evasion-prone spellings back to the canonical name

Build a :class:`Baseline` from a parsed mapping (YAML/JSON).

Build the LLM prompt for a single batch. Delegates to the parent's :meth:`build_prompt`, which wraps the analyzer prompt with line-nu

Create ``ChatOpenAI`` for providers serving OpenAI-compatible endpoints.

Input token budget for *model* (75 %% of context window).

Get default remediation for a pattern ID.

Increment the retry-success counter for reporting. Only call this when a retry (after a key switch due to 429) actually succeeds, not

Execute LLM calls for all *batches*, returning per-batch parsed results. The element type of the inner list depends on the subclass: the defa

Return a snapshot dict suitable for report metadata.

Non-blocking acquire — returns a key immediately or ``None``. Unlike :meth:`acquire`, this never blocks. If a slot is available righ

Apply all 7 compatibility patches (idempotent — safe to nest). Uses a nesting counter instead of a boolean flag so that nested ``with deepsee

Return True for markdown files in documentation subdirectories (not SKILL.md).

Check if path is a Git repository URL.

Heuristic: open() is a write sink if mode arg contains 'w' or 'a'.

Return a human-readable degraded-scan warning, or None if not degraded.

Return ``(attempted, succeeded, degraded)`` from the LLM call log. ``degraded`` is True when the LLM stage was requested and at least one call

Populate root with skill spec: SKILL.md, references/, scripts/, assets/.

Case-insensitive glob match; ``**`` is treated as an alias for ``*``. Patterns use :func:`fnmatch.fnmatch` semantics, so ``*``, ``?`` and ``[...]

Seconds until the earliest rate-limited key recovers, or ``None``.