Clean skill produces no MCP findings through full pipeline.

TP1+TP2 findings survive meta_analyzer filtering.

Real loopback default URLs stay exempt (regression guard).

git reset --hard inside 'example:' context is filtered.

Both instances confirmed independently via start_line.

Two findings with the same rule_id in one file; LLM confirms only one.

Invalid skill_path raises instead of returning a clean low-risk report.

Graph runs to completion; returns findings, SARIF report, report_body, risk_score.

Invoking with output_format=json yields report_body as valid JSON with skill and risk_assessment.

End-to-end: use_llm requested but every LLM call fails. Proves (a) the operator.add reducer accumulates llm_call_log across the parallel anal

Guard should pass even after patches were applied and restored.

Guard should pass after setup_deepseek_compat() + manual restore.

If upstream removes 'base_prompt' from __init__, guard must raise.

If Batch.file_path field is removed, guard must raise. Batch is a @dataclass — we test by removing the field from __dataclass_fields__.

If parse_response no longer accepts 'batch', guard must raise.

If MetaAnalyzerResult no longer has 'findings' field.

If build_prompt no longer accepts **kwargs.

If asyncio.run signature changes, guard uses saved _original_asyncio_run.

If upstream removes 'model' from __init__, guard must raise.

If LLMAnalysisResult.model_validate is removed, guard must raise. model_validate is a Pydantic metaclass-injected classmethod that ca

If asyncio.new_event_loop is removed, guard must raise.

If upstream removes response_schema class attr, guard must raise.

If LLMFinding.to_finding is removed, guard must raise.

Entering context manager must not raise.

Edge: opening ``` but no closing ``` — should not crash.

Directories starting with '.' are not scanned for skills.

HIGH finding at 0.2 confidence is retained (severity floor).

Finding with high confidence passes through.

A HIGH static finding NOT confirmed by the LLM must be kept. Same invariant as CRITICAL: the original finding is preserved and tagged

Name with Cyrillic 'а' (U+0430) → TP2 finding, confidence >= 0.90.

Description with HTML comment → TP1 finding, HIGH severity, confidence >= 0.90.

https URLs continue to extract the host via urlparse without hitting the scp fallback.

Unchanged file content must produce the same hash.

Returns empty findings when current and previous manifests are identical.

``import builtins as b2; b2.exec(...)`` must still raise AST1.

``import builtins as b2; b2.exec(input())`` must raise TT5.

``import builtins; builtins.exec(...)`` must still raise AST1.

``import builtins; builtins.exec(input())`` must raise TT5.

Subprocess isolation: import runner → __init__ unchanged.

A benign dynamic import (``json.loads``) must not be treated as an exec sink.

A benign dynamic import (``json.loads``) must not match a sink ladder.

``importlib.import_module('os').system(...)`` must raise AST5.

``importlib.import_module('os').system(input())`` must raise TT5.

``importlib.import_module('subprocess').run(...)`` must raise AST4.

``importlib.import_module('subprocess').run(input())`` must raise TT5.

Content containing '--dangerously-skip-permissions' must never reach argv.

Parameter description with 'ignore previous instructions' → TP3 finding.

An injected shell command must come back as analysis text, not run.

Newlines and shell meta-chars in content must not break the argv list.

Two instances each get their own response_schema=None; class attr intact. This is the core V2 fix: ``self.response_schema = None`` writes to

HTML comment with instruction keyword → TP1, confidence >= 0.95.