feat: subprocess provider, SQLite LLM cache, meta-analyzer batching, and scan UX improvements

[scholesgx]

What this PR does

The best time to scan a skill is the moment you're deciding whether to install it — which is usually inside an agent session (Claude Code, Cursor, Copilot, etc.), not before one. Until now, SkillSpector's LLM analysis required a separate API key configured outside the session, making it impractical to use the full scanner from within the same environment you're already working in.

This PR fixes that. With SKILLSPECTOR_PROVIDER=subprocess, you point SkillSpector at any AI CLI already available in your session — claude -p, antigravity ask, or similar — and it uses that as the LLM backend. No additional API key. No separate authentication. If you're already in an agent session, you can run a full LLM-powered scan right there.

Changes

New: subprocess provider

Run SkillSpector's LLM analysis from within your existing agent session — no separate API key required.

export SKILLSPECTOR_PROVIDER=subprocess
export SKILLSPECTOR_LLM_COMMAND="claude -p"
skillspector scan ./the-skill-im-about-to-install/

SubprocessProvider / SubprocessChatModel pipes each prompt to the configured shell command via stdin and reads the response from stdout. Works with any CLI-based AI: claude -p, antigravity ask, openclaw chat, or a custom wrapper script. Windows-compatible, with clear error messages when the command is missing or exits non-zero.

New: SQLite LLM response cache

LLMResponseCache persists LLM responses keyed by content hash to .skillspector-cache.db. Re-scanning the same skill content skips redundant LLM calls entirely. Particularly useful with the subprocess provider, where each call has visible latency in the session.

New: scan cost controls

• --skip-meta — bypass the meta-analyzer LLM pass for fast iterative scanning. Cuts token cost ~40–60% at the cost of more false positives. Recommended during development; drop it for final/CI runs.
• SKILLSPECTOR_META_BATCH_SIZE — tune findings-per-LLM-call without touching code.

New: multi-skill scanning

• --recursive — scan a directory of skills independently, with per-skill risk scores and a combined summary.
• --depth N — control nesting depth (default: 1).
• --detail — include full finding objects in recursive JSON output.

New: test-fixture heuristics

AST4 and PE3 findings that match safe test-harness patterns are automatically downgraded to low confidence rather than flagged at full severity. --include-test-fixtures opts out when you want to audit test code at full sensitivity.

Other improvements

• offensive_security classification — skills that declare this skip the score-based DO NOT INSTALL recommendation (security tools are expected to contain threat signatures).
• Auto-discover .skillspector-baseline.yaml in the target directory; --no-baseline to opt out.
• skillspector baseline writes to the target directory by default rather than CWD.
• LLM progress emitted to stderr so JSON output to stdout stays parseable in CI pipelines.
• LP1/LP3 remediation messages include accepted capability type names and a code snippet.
• TP4 prompt hardened against enterprise injection-detection false triggers.
• YARA YR1/YR4 confidence reduced when surrounding context is negation or educational.

Test plan

• uv run pytest — full suite passes with no regressions
• Static-only scan unchanged: skillspector scan ./my-skill/ --no-llm matches output from main
• Subprocess provider — from within an active Claude Code session: SKILLSPECTOR_PROVIDER=subprocess SKILLSPECTOR_LLM_COMMAND="claude -p" skillspector scan ./my-skill/ completes full LLM analysis without a separate API key
• --skip-meta visibly skips the meta-analyzer pass and runs faster
• Second scan of the same content hits the cache (.skillspector-cache.db present, no LLM calls observed)
• skillspector scan ./skills-dir/ --recursive produces independent per-skill results with a combined summary
• skillspector baseline writes the baseline file into the scanned directory, not CWD

🤖 Generated with Claude Code