fix(analyzer): rely on runner for SC7 example filtering to close executable bypass

SC7 called is_code_example() with an unconditional continue, letting a nearby example marker (e.g. a '# for example' comment a few lines from a content-trust bypass) suppress the rule in executable files. The shared runner already filters examples in non-executable docs and only downweights executables, so the analyzer-level call was redundant and created an attacker-controlled bypass. Drop it and rely on the runner's file-type-aware handling; add an executable-file evasion regression test. Addresses review feedback on #224.

Signed-off-by: CharmingGroot <ohyes9711@gmail.com>

Author: CharmingGroot

src/skillspector/nodes/analyzers/static_patterns_supply_chain.py

@@ -37,7 +37,7 @@
 from skillspector.state import AnalyzerNodeResponse, SkillspectorState
 
 from . import static_runner
-from .common import get_context, get_line_number, is_code_example
+from .common import get_context, get_line_number
 from .osv_client import ECOSYSTEM_NPM, ECOSYSTEM_PYPI, VulnResult, query_batch, was_osv_reachable
 from .pattern_defaults import PatternCategory
 from .static_runner import analyzer_finding_to_finding
@@ -585,13 +585,12 @@ def ctx(start: int) -> str:
                         matched_text=match.group(0)[:200],
                     )
                 )
-    # SC7: untrusted container image. Filtered through is_code_example() because
-    # these flags appear in SKILL.md docs and "never do this" warnings.
+    # SC7: untrusted container image. Example handling is left to the shared
+    # runner, which suppresses matches in non-executable docs and only
+    # downweights (does not skip) executables — so an in-code "example" marker
+    # cannot bypass the rule in a shell script.
     for pattern, confidence in SC7_PATTERNS:
         for match in re.finditer(pattern, content, re.IGNORECASE | re.MULTILINE):
-            context_text = ctx(match.start())
-            if is_code_example(context_text):
-                continue
             line_num = get_line_number(content, match.start())
             findings.append(
                 AnalyzerFinding(
@@ -601,7 +600,7 @@ def ctx(start: int) -> str:
                     location=loc(line_num),
                     confidence=confidence,
                     tags=tag,
-                    context=context_text,
+                    context=ctx(match.start()),
                     matched_text=match.group(0)[:200],
                 )
             )

tests/nodes/analyzers/test_static_patterns.py

@@ -239,6 +239,21 @@ def test_sc7_benign_pull_no_finding(self):
         findings = static_runner.run_static_patterns(state, [supply_chain_module])
         assert not any(f.rule_id == "SC7" for f in findings)
 
+    def test_sc7_example_marker_in_executable_still_fires(self):
+        """An 'example' marker near a bypass in an executable .sh must NOT suppress SC7.
+
+        Example filtering belongs to the runner, which only downweights (does not
+        skip) executables — so a nearby '# for example' cannot be used to evade SC7.
+        """
+        state = {
+            "components": ["setup.sh"],
+            "file_cache": {
+                "setup.sh": "# for example\ndocker pull --disable-content-trust registry.io/x",
+            },
+        }
+        findings = static_runner.run_static_patterns(state, [supply_chain_module])
+        assert any(f.rule_id == "SC7" for f in findings)
+
 
 class TestRunStaticPatternsAgentSnoopingAdditional:
     """run_static_patterns with agent_snooping: AS1, AS2, AS3."""