fix(static): detect literal shell flag assignments

[deepujain]

Summary

• detect a local True assignment used as shell= by subprocess calls
• bound the assignment-to-call relationship to nearby source lines
• add a regression for shell=True detection can be bypassed through variable assignment (malicious skill example that bypasses this static detection model) #475

Fixes #475

Validation

• ruff check
• ruff format --check
• py_compile
• git diff --check

[rng1995]

[SkillSpector Review]

Reviewed current head 9674f96839794d3fdfaf03275fa8c23fa507c4ae. The positive regression covers the reported literal-variable form and all hosted checks pass, but the new regex treats the first nearby True assignment as authoritative even when the same name is rebound before the subprocess call. That creates a high-confidence TM finding for code which explicitly uses False.

Please make the assignment-to-use relation reject intervening writes (or use the existing Python/AST analysis path for this data-flow fact), and add negative regressions for flag = True; flag = False; subprocess.run(..., shell=flag) plus a nearby assignment in an unrelated scope. The inline comment identifies the affected matcher.

[rng1995]

[SkillSpector Review]

Re-reviewed current head c6d15a0a065fae60264bb7a70d55410e8a9d4173 against the prior finding, complete regex/test diff, Python scope behavior, and exact-head checks.

The intervening reassignment case is fixed, but the other requested boundary remains: the regex still treats same-spelled names in nearby, unrelated scopes as one data-flow fact. For example, a use_shell = True local in one function followed within four lines by subprocess.run(..., shell=use_shell) in another function still emits TM1 even though the assignment cannot reach the call. Use the shared Python AST/scope information (preferred), or otherwise require a demonstrably same-scope effective assignment, and add the unrelated-scope negative regression requested in the prior review.

Five exact-head checks pass, but docker-smoke fails. The remaining correctness issue, active change request, failed check, and GitHub BLOCKED state prevent merge.

Priority: P1 — high-confidence shell-execution false positives directly affect risk scoring.

[deepujain]

All review comments are addressed on the current head 426b0ed:

• rng1995 P1 (bounded gap carrying True across an intervening reassignment): fixed in 426b0ed (fix(static): respect shell flag reassignment); the matcher rejects an intervening write to the captured shell variable, with a negative regression.

CI is green on this head: https://github.com/NVIDIA/SkillSpector/actions/runs/35404573044 (lint, test-unit, docker-smoke, DCO). Per your 2026-09-18 note, this PR is ready for re-review.

[deepujain]

Addressed the remaining scope boundary in d830a71: the variable shell flag regex matched across Python scopes, so use_shell = True in one function and shell=use_shell in another emitted TM1. The matched assignment and shell= use are now resolved through the Python AST and cross-scope candidates are dropped; closure reads and global/nonlocal declarations are preserved. Unrelated-scope negative regression added, plus closure and global keep-regressions.

CI is re-running on this head.