Finding model for graph state and report output (shape aligned with to_dict).

One unit of work for an LLM call (single file or file-chunk).

Common finding type produced by any analyzer (static, behavioral, MCP, semantic). Converted to Finding for graph state; use severity, locatio

Structured LLM response containing discovered findings.

A single finding discovered by an LLM analyzer. Field names intentionally mirror :class:`~skillspector.models.Finding` so that :meth:`to_find

Per-file LLM filter/enrichment of static findings. Uses :class:`MetaAnalyzerResult` as the structured output schema so the LLM response is va

Per-file / per-chunk LLM analyzer. Subclass, supply an ``analyzer_prompt`` string, and optionally override :meth:`build_prompt` / :meth:`pars

Location of a finding within a file (used by all analyzers).

Handles input resolution for different source types. Normalizes all inputs to a local directory path for scanning.

AWS Bedrock provider — SigV4 auth via boto3, bundled-YAML metadata.

A single finding evaluated by the meta-analyzer LLM (filter/enrich mode).

A glob-based suppression rule. Empty rules (no field set) never match.

Raised when an agent CLI call fails for any reason (fail-closed).

build.nvidia.com credentials + bundled-YAML metadata provider.

Loaded baseline: glob rules plus exact fingerprint suppressions.

LLM analyzer covering the 8 gap-fill rules for non-English skills. Extends :class:`~skillspector.llm_analyzer_base.LLMAnalyzerBase` with a la

Stock OpenAI credentials + bundled-YAML metadata provider.

Anthropic proxy provider for Vertex-style raw-predict endpoints.

Anthropic credentials + bundled-YAML metadata provider.

Claude CLI provider (no API key; uses the local ``claude`` login). No model is pinned: ``claude`` runs with the user's own default model and

Codex CLI provider (no API key; uses the local ``codex`` login). No model is pinned: ``codex`` runs with the account's own default model (som

Top-level structured response from the meta-analyzer LLM.

Result of scanning a directory for multiple skills.

SARIF message object (required: text).

A detected skill within a multi-skill directory.

Antigravity CLI provider (registered but disabled; fail-closed). ``agy`` cannot be captured from a pipe (TTY-only print mode) — see the module

A single API key with concurrency and rate-limit metadata. Attributes ---------- key : API key string (e.g. ``"sk-or-xxx"``).

Everything provider-specific about one agent CLI, behind one lookup.

LangChain-compatible chat model wrapper with transparent key switching. Each :meth:`invoke` / :meth:`ainvoke` call acquires a key from the pool,

A single vulnerability found for a package.

Context manager to temporarily replace / delete an attribute on an object. Usage:: with _TempAttributeOverride(LLMAnalysisResult, "model

Thread-safe pool of API keys with per-key concurrency slots. Each key has *max_concurrent* slots (default 5). :meth:`acquire` picks the leas

Tiny schema used to validate provider structured-output wiring.

Reference to an artifact (file) in the run.

Result location (physical and/or logical).

Physical location (artifact + optional region).

Region within an artifact (line/column range).

A single analysis result (finding).

A single vulnerability finding from a gap-fill LLM call.

Tool driver (required: name; optional: version, rules).

Top-level SARIF log (SARIF 2.1.0).

A single run (one tool invocation).

Tool that produced the run.

Sync httpx transport that rewrites Anthropic SDK requests for the proxy.

Test analyzer for raw-string mode.

Minimal ``ChatOpenAI``-compatible adapter backed by a CLI provider. Implements only the surface the analyzers use: ``invoke`` (returns an obj

Structured LLM response for the gap-fill analyzer.

Gemini CLI provider (no API key; uses the local ``gemini`` login).

Describes a single tool invocation (SARIF ``run.invocations[]``). ``executionSuccessful`` is required by the SARIF spec. SkillSpector keeps it

A notification about a condition encountered during tool execution. Used to surface a degraded LLM stage (requested but every call failed) in

Rule metadata (SARIF reportingDescriptor).

SARIF suppression object — marks a result as suppressed (e.g. via a baseline).

A finding paired with the reason it was suppressed.

Minimal stand-in for a LangChain message: exposes ``.content``.

``ChatAnthropic`` subclass that routes requests through a custom proxy.

Stand-in for ``subprocess.Popen`` that ``run_agent_cli``'s bounded reader (`_run_bounded`) can drive: stdin/stdout/stderr streams plus wait/kill.

Async httpx transport that rewrites Anthropic SDK requests for the proxy.

Mimics ``ChatOpenAI.with_structured_output(schema)`` for a CLI provider. ``invoke`` augments the prompt with the schema, calls the provider's

Optional extension for providers that drive a local agent CLI. Providers that implement these two methods opt in to the CLI transport path in

Base for providers that drive a local agent CLI (no API key needed).

Strict analyzer update payload for graph state.

Analyzer plugin protocol: name/stage/availability and an ``analyze`` entry point.

Anything that can construct its native LangChain chat model.

Anything that can supply ``(api_key, base_url)`` for the LLM client. Implementations return ``None`` when the relevant environment is not con

Output format choices for the CLI.

One LLM-stage telemetry record (an entry in ``llm_call_log``).

Complete provider surface used by SkillSpector's LLM stack.

Strict meta-analyzer update payload for graph state.

Provider-side knowledge about models — token budgets and defaults. ``get_context_length`` / ``get_max_output_tokens`` return ``None`` to sign

Overall risk assessment for the analyzed file.

Categories of vulnerability patterns.

Artifact (file) analyzed in the run.

Severity levels for findings (used by all analyzers).

Graph state shared by all nodes.

#5: release(success=True) uses real flow, not manual state injection.

#7: acquire(timeout=...) path — previously zero coverage.

End-to-end graph scan driven by a CLI provider (expensive; claude only). The graph integration path (``AgentCLIChatModel`` -> meta_analyzer) is

Smoke tests that drive each real CLI through the hardened runner.

Allowlists contain expected hosts.

Registry matches the expected node set and order.

#27: Coverage for the annotation layer Max praised.

Anthropic provider — Claude credentials + bundled YAML metadata.

Chat model creation tests.

Credential resolution tests.

Token-budget metadata and model resolution tests.

AR1: refusal suppression.

AR2: disclaimer / caveat suppression.

AR3: safety / policy nullification.

Obfuscations a simple regex engine does not yet catch (under-detection).

Benign prose that currently fires (over-detection).

The analyzer node runs over graph state and returns findings.

Benign content must not trip the analyzer.

Antigravity CLI provider — registered but disabled; must fail closed.

`agy` is registered but disabled (TTY-only, uncapturable): fail closed.

Tests for ANTHROPIC_PROXY_API_VERSION env var.