Sync OSS release snapshot

.gitignore

@@ -98,6 +98,7 @@ tmp/
 temp/
 .skillspector/
 .provider-test-missing-keys
+.pr-review-work/
 
 # API Keys (never commit!)
 .env.local

Makefile

@@ -152,3 +152,4 @@ docker-build:
 # Build and smoke test the Docker image
 docker-smoke: docker-build
 	tests/docker/smoke.sh
+

docs/B.3.1-mcp-least-privilege.md

@@ -1,6 +1,6 @@
 # B.3.1: MCP Least-Privilege Analysis (LP1 -- LP4)
 
-**Author:** Nir Paz | **Date:** 2026-03-30 | **Status:** Implemented
+**Author:** Nir Paz | **Date:** 2026-03-30 | **Status:** Implemented  
 **Component:** `src/skillspector/nodes/analyzers/mcp_least_privilege.py`
 
 ---

docs/B.3.2-mcp-tool-poisoning.md

@@ -1,6 +1,6 @@
 # B.3.2: MCP Tool-Poisoning Detection (TP1 -- TP4)
 
-**Author:** Nir Paz | **Date:** 2026-03-30 | **Status:** Implemented
+**Author:** Nir Paz | **Date:** 2026-03-30 | **Status:** Implemented  
 **Component:** `src/skillspector/nodes/analyzers/mcp_tool_poisoning.py`
 
 ---

docs/SC4-osv-live-vulnerability-lookups.md

@@ -1,6 +1,6 @@
 # SC4: Live Vulnerability Lookups via OSV.dev
 
-**Author:** Nraghavan | **Date:** 2026-03-17 | **Status:** Implemented
+**Author:** Nraghavan | **Date:** 2026-03-17 | **Status:** Implemented  
 **Component:** `static_patterns_supply_chain.py` (SC4 rule), `osv_client.py`
 
 ---

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "skillspector"
-version = "2.3.7"
+version = "2.3.9"
 description = "SkillSpector: Security scanner for AI agent skills (Claude Code, Cursor, and similar). Scans skills for vulnerabilities, malicious patterns, and security risks before installation. Supports Git repos, URLs, zips, and local directories; runs static pattern checks and optional LLM semantic analysis; outputs terminal, JSON, and Markdown reports with risk scoring."
 readme = "README.md"
 license = "Apache-2.0"

src/skillspector/nodes/analyzers/mcp_least_privilege.py

@@ -360,7 +360,7 @@ def node(state: SkillspectorState) -> AnalyzerNodeResponse:
                 )
 
         # --- LP4: Over-declared permissions (only when permissions field is set) ---
-        for perm in (permissions or []):
+        for perm in permissions or []:
             perm_lower = perm.strip().lower()
             # Skip wildcard entries themselves
             if perm_lower in _WILDCARD_PERMS:

tests/integration/__init__.py

@@ -12,3 +12,4 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+

tests/unit/__init__.py

@@ -12,3 +12,4 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+