Pass all findings through with default remediations (fail-closed). Used on LLM failure path: when the LLM call fails, we pass ALL findings th

Best-effort relative name for display in progress lines.

Skip the current test unless *cli* is installed AND authenticated.

Scan each detected sub-skill independently and produce a combined report.

Build initial graph state from scan CLI args.

Collapse a ``builtins``-qualified name back to its bare builtin name. ``builtins.exec`` → ``exec`` (and ``builtins.eval``/``compile``/``__import_

Build a baseline mapping that fingerprint-suppresses every given finding.

Write a baseline mapping to *path* as YAML (``.json`` extension -> JSON).

Raise the shared no-LLM-credentials error.

Extract a dotted call name like ``'os.system'`` from a Call node. When *aliases* (from :func:`build_import_aliases`) is supplied, locally aliased

Like ``resolve_call_name`` but consults *type_map* for instance methods. For ``sock.recv(1024)`` where *type_map* maps ``sock`` → ``socket.socket

Run a single targeted LLM pass covering the 8 gap-fill rules. Convenience wrapper that instantiates :class:`GapFillAnalyzer`, creates batches

Build the initial LangGraph state for a single skill directory.

Set the package root logger and its handler level (e.g. for CLI --verbose).

Return True if the last query_batch() call succeeded. Callers can use this to decide whether to surface a fallback warning when query_batch r

Map locally imported names to their fully-qualified module paths. ``from pathlib import Path`` → ``{"Path": "pathlib.Path"}`` ``import socket

Build a fresh :class:`~langchain_openai.ChatOpenAI` for *key*.

Build LangSmith trace config for a scan invocation.

Remove temp dir from graph result if set.

Clear all functools.cache caches across model_info and the providers.

LLM item confirming a finding, as parse_response would emit it.

Walk children to find a nested dangerous call that forms a chain.

Convert parameters list of dicts to a map of lowercase parameter names -> properties.

Check if directory contains a SKILL.md or skill.md at root level.

Return True if any permission value is a wildcard.

True if this call is exec(), eval(), or compile() — the outer dangerous call.

Return True for standard Dockerfile cleanup/setup patterns.

Read *yaml_path* and return its ``models`` map (cached). Returns an empty dict if the path is empty, missing, or unreadable — callers fall th

Extract provider-normalized text from a LangChain chat response.

Return the standard OpenAI fallback provider.

Parse SKILL.md or skill.md YAML frontmatter into a manifest dict. Returns dict with name, description, triggers (list), permissions (list), a

Choose the most specific rule ID for a source->sink pair.

Lightweight file read for language detection and gap-fill. Mirrors the file-walk rules in :func:`skillspector.nodes.build_context._walk_skill

Return the context window size for *model_label*. Delegates to the configured provider chain; falls back to :data:`DEFAULT_CONTEXT_LENGTH` wi

Return the user override path if set, otherwise *default_yaml_path*.

Restore all original class methods / functions (nesting-aware). Only actually restores when the outermost context manager exits (_patches_dep

Build a proxy-compatible request from an Anthropic SDK request.

Return a copy of *finding* with control/ANSI bytes stripped from text fields.

Map Finding.severity to SARIF result level.

Wrap a single file in a temporary directory for consistent handling.

Map locally bound names to their fully-qualified import paths. Public entry point around the import scan already used by :func:`build_type_map`.

Clear the in-memory vulnerability cache.

Return the absolute path of *name* on PATH, or ``None`` if absent.

Return the active provider (alias for :func:`get_metadata_provider`). Preferred over :func:`get_metadata_provider` when callers also need to

Extract surrounding lines given pre-split *lines* and a 1-based *lineno*.

Look up *model*'s context window in the bundled ``model_registry.yaml``.

Get default explanation for a pattern ID.

Look up *model*'s max-output cap in the bundled ``model_registry.yaml``.

Extract the source text for a given line range, truncated to 200 chars.

Return the :class:`CliSpec` for *name*, or raise for an unknown CLI.

Synchronous invoke with automatic key switching on rate-limit.

Convert the validated Pydantic response to dicts for ``apply_filter``.

Return credentials used for chat model construction, including fallback.

Return ``(api_key, base_url)`` from ``OPENAI_API_KEY`` / ``OPENAI_BASE_URL``.

Resolve ``importlib.import_module('mod').attr(...)`` to the dotted sink ``'mod.attr'``. Bridges the dynamic-import evasion that mirrors ``__impor

Convert to a :class:`Finding` for the graph state.

Async retry loop — non-blocking acquire first, block only if full.

Run SC4/SC5/SC6 checks on dependency files.