[agentsope]

Summary

Fixes #842.

Add scan --recursive --max-skills N for local multi-skill collections. The default remains 32; explicit values must be positive integers, with no unlimited sentinel. The existing discovery, traversal, byte, finding-record and serialized-output budgets remain in force.

When the skill-count limit is reached, print its value and suggest increasing --max-skills or scanning sub-skills separately. Keep the existing machine-readable limitation, omitted counts, incomplete coverage and exit-policy behavior. Document the option and limitations in README and CLI help.

Explicit --max-skills is rejected outside local recursive collection scans, including inputs that discover no sub-skills, rather than silently ignoring it.

Validation

• CLI, recursive discovery and CLI subprocess selection: 394 passed.
• Full non-integration/non-provider test selection: 14,023 passed, 14 skipped, 245 deselected, 4 xfailed; seven warnings remain (unregistered timeout markers and the duplicate-archive-member fixture).
• Independent real static scans of 33 synthetic local skills: default scans 32 and reports one omitted; --max-skills 33 scans all 33. JSON remains parseable and execution succeeds. No child-scan mock was used in these two checks.
• Regression/control coverage includes lower/default/higher count limits, strict incomplete exit behavior, invalid values, unsupported input modes, help text, CLI dispatch and retaining the global public-record budget when the requested count increases.
• Repository-wide Ruff lint/format and git diff --check pass.
• Targeted mypy reports nine existing diagnostics. A pristine-main shadow-file check reports the same nine diagnostics; a clean type-check is not claimed.

The initial full run had 51 failures in the localhost TP4 HTTP transport tests. A pristine-main CLI control reproduced the first failure. Setting NO_PROXY/no_proxy to 127.0.0.1,localhost for the test process made that entire 51-test file pass; the full suite above was then rerun with the same loopback bypass and passed. No global proxy configuration, test assertions or project dependency manifests were changed. The launcher also bypassed the local Anaconda readline issue in-process only.

No live provider/LLM calls were used. Local dependencies were synchronized from the existing lockfile before testing.

Scope and tradeoffs

• Raising the count does not guarantee complete coverage: the other aggregate limits can still stop the scan.
• Default exit behavior is unchanged. Use --fail-on-incomplete or --min-coverage where incomplete scans must fail CI.
• No automatic batching, unlimited mode, remote recursive support, new environment variable or discovery-budget redesign is included.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[agentsope]

Fixed the CI help-text assertion in signed follow-up commit d64edcd.

The failed unit job reported 14,127 passes and one failure: test_cli_max_skills_is_documented_in_help. Typer/Rich emits ANSI styling in the GitHub Actions terminal environment, which can interrupt the literal --max-skills string. I reproduced both parameterized cases failing with GitHub Actions-style terminal settings before applying normalization.

The test now removes ANSI styling with click.unstyle before checking the option and default 32. It explicitly exercises both colored and uncolored rendering and asserts that the requested ANSI mode really occurred. Typer initializes its terminal settings at import time, so the fixture controls those rendering settings directly and restores them afterward. The content assertions remain in place; no tests were skipped or weakened, and no production code changed.

Validation on this follow-up:

• CLI, recursive discovery and CLI subprocess selection: 395 passed.
• GitHub Actions-style terminal selection for max-skills/count behavior: 20 passed.
• Both help-rendering cases pass in ordinary and GitHub Actions-style environments.
• Repository-wide Ruff lint/format and git diff --check pass.

The complete offline suite was not rerun for this test-only follow-up. The prior 14,023-pass full local run remains evidence for the original production change; hosted CI will recheck the new head.

[agentsope]

CI follow-up: the help-text assertion is now passing. The remaining failures are also present on upstream main.

Evidence from the hosted logs:

• This PR at d64edcd, tested as merge commit ab84327 against main cf5cac7: https://github.com/NVIDIA/SkillSpector/actions/runs/38993821710 — 14,265 passed, 6 failed. All failures are test_real_binary_structure_is_not_instruction_noise in tests/nodes/test_security_remediation.py:4100: the PDF/GIF parameterizations exceed the 10-second wall-clock assertion (approximately 10.5–11.4 seconds).
• The exact main baseline cf5cac7: https://github.com/NVIDIA/SkillSpector/actions/runs/38951050764 — the same test family already fails on the False-True-pdf parameterization (approximately 10.45 seconds).
• A newer main run at 02aa10c: https://github.com/NVIDIA/SkillSpector/actions/runs/39007069619 — all six identical PDF/GIF parameterizations fail the same timing assertion; 14,288 tests pass.

The PR changes only README, cli.py and tests/unit/test_cli.py; it does not modify the binary analysis implementation or those timing tests. These observations establish an existing upstream timing failure, but do not identify its underlying performance or runner cause. I have not loosened the threshold, skipped tests, or rerun CI to mask it. The check is still red, and this is not a claim that the PR has a green full hosted run.

[Yoseph-Zuskin]

Hi @agentsope, the cause of the CI failure has been fixed by #862, you can merge upstream/main into the branch on your fork to pass the test-unit job.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[rng1995]

[SkillSpector Review]

Value and readiness

A positive --max-skills lets local recursive collections exceed the existing 32-skill default while retaining byte, traversal, runtime, finding and output budgets. I found no required code change at aa9e4dae9715b509330314f362c0e69e007607a5.

Material findings

No required change found. CLI validation rejects invalid counts and non-collection modes; the helper independently rejects bool/non-integer/nonpositive values. The selected limit is used only at the existing count gate. Omitted counts, incomplete coverage, risk recommendation and strict exit policy remain explicit. Higher requested counts do not multiply the public-record budget.

PIC tradeoffs

Increasing the count trades scan capacity for work, and other aggregate limits can still stop the scan. The help and README explain this.

Verification and gaps

Read the entire README/CLI/test diff, pinned source and validation report, and automated quota notices. Regressions cover low/default/high limits, dispatch, invalid modes, help rendering, incomplete exits and global record budgets. All six hosted checks succeeded. Static review only; no PR code or tests were run.