fix(as3): ignore current-skill self references

[chrisknvidia]

Summary

• suppress AS3 only when a literal skills/<name>/SKILL.md path identifies the skill currently being scanned
• derive current-skill identity from the scan-root basename and manifest name
• preserve peer-skill, transformed/obfuscated path, explicit enumeration, AS1, and AS2 findings
• exclude suppressed findings before finding-budget and inspection-ledger accounting
• add unit and real no-LLM CLI regression coverage

Validation

• uv run --no-sync pytest -q tests/nodes/analyzers/test_static_patterns.py -k AgentSnooping — 22 passed
• uv run --no-sync pytest -q tests/unit/test_cli.py -k as3_self_reference — 1 passed
• real no-LLM CLI fixture — current-skill reference suppressed; peer-skill reference retained
• local uv run --no-sync make test-ci — 3,997 passed, 14 skipped, 38 deselected, 4 xfailed
• GitHub Actions CI — all 5 jobs passed; test-unit reported the same counts
• uv run --no-sync make lint — passed
• uv run --no-sync make format-check — passed
• targeted mypy for changed production modules — passed
• Docker build and tests/docker/smoke.sh — passed, including local and public-repository scans
• git diff --check origin/main...HEAD — passed

Security behavior

Suppression is restricted to unchanged literal source spans naming the current skill. References reconstructed through normalized or compact security views remain findings, as do references to peer skills.

Refs #500

AI assistance disclosure: Codex assisted with source inspection, regression tests, implementation, and review. I reviewed and verified the change.

[chrisknvidia]

@greptileai please review.

[rng1995]

[SkillSpector Review]

Reviewed head b99c4895ab6b2c4eefc95f9d9e288a29d012928c — REQUEST_CHANGES.

• src/skillspector/nodes/analyzers/static_patterns_agent_snooping.py:204: replacing _ with - collapses distinct filesystem names. If the current skill is example-skill, a literal access to the separate path skills/example_skill/SKILL.md is suppressed as self-access, creating an AS3 false negative. Compare path identities without aliasing distinct directory names (unless a trusted installation mapping proves equivalence), and add the peer-path regression.
• src/skillspector/nodes/analyzers/static_patterns_agent_snooping.py:227-231: basename and manifest identities are unioned even when they disagree. Because manifest metadata is contributor-controlled, a skill can declare a peer's name and suppress a literal access to that peer. When multiple identity signals are present but inconsistent, fail closed or derive the install identity from trusted discovery context; add a mismatched-name regression.

Required checks pass, but these fail-open suppressions and mergeStateStatus=BEHIND block merging.

[rng1995]

[SkillSpector Review]

Re-reviewed current head ec79aa9b5d1224f584af9d3c5e50acd47546f735 after the marked review at b99c4895ab6b2c4eefc95f9d9e288a29d012928c. The synchronized runner context was assessed and both AS3 fail-open suppressions remain unchanged.

At static_patterns_agent_snooping.py:204, underscore-to-hyphen normalization still aliases distinct filesystem names, so a peer such as example_skill can be suppressed while scanning example-skill. At lines 223-231, path and contributor-controlled manifest identities are still unioned even when inconsistent, allowing a manifest to name a peer and suppress access to it. Preserve distinct path identities and require a trusted, consistent current-skill identity; add both regressions.

All hosted checks pass, but the required corrections and mergeStateStatus=BEHIND block approval and merging.