Starstruk Logo MarkStarstruk

v2.9.6

FalkorDB/FalkorDBv2.9.6Aug 18, 2026by github-actions[bot]

AI Summary

SkillSpector 2.9.6 fixes high-severity false positives in OAuth documentation by distinguishing between glossary entries and actual credential-access instructions.

Key Highlights

  • Stop flagging ordinary OAuth glossary entries as credential-access findings
  • Preserve PE3 findings for imperative access instructions
  • Classify noun-shaped 'access token' terminology using bounded grammar

New Features

  • Add benign regression coverage for OAuth terminology
  • Classify noun-shaped access token terminology using bounded grammatical context
  • Preserve PE3 findings for imperative access instructions

Full Release Notes

# SkillSpector v2.9.6

Released: 2026-08-18

## Summary

SkillSpector 2.9.6 improves PE3 credential-access accuracy for OAuth documentation. It now distinguishes compound-noun uses of `access token` and `access tokens` from instructions that access credentials, removing HIGH-severity false positives without weakening detection of actionable credential access.

## Highlights

- Stop flagging ordinary OAuth glossary entries, return-value descriptions, revocation behavior, storage guidance, and supported-token tables as credential-access findings.
- Preserve PE3 findings for imperative and modal access instructions, sensitive credential sources, and read, copy, send, post, leak, and exfiltration actions.

## Added

- Add benign and adversarial regression coverage for OAuth terminology in Markdown tables, headings, later clauses, URL navigation, action inflections, and HTTP POST token flows.

## Changed

- Classify noun-shaped `access token` terminology in documentation using bounded grammatical context instead of a narrow OAuth lifecycle allowlist.

## Fixed

- Prevent ordinary OAuth terminology in documentation from producing HIGH-severity PE3 findings while retaining findings for credential-access actions embedded in or adjacent to benign prose.

## Security

- Keep the OAuth documentation exception fail-closed when bounded context contains credential actions or sensitive sources.

## Breaking Changes and Migration

- None.

## Deprecations

- None.

## Validation

- `uv run pytest -q tests/unit/test_patterns.py tests/nodes/analyzers/test_binary_and_pe3_filtering.py tests/nodes/analyzers/test_static_runner_filtering.py` — 204 passed.
- `uv run pytest -q --ignore=tests/unit/test_input_handler.py --ignore=tests/unit/test_input_handler_ssrf.py` — 2,158 passed, 13 skipped, and 4 expected failures.
- `uv run ruff check src/ tests/` — passed.
- `uv run ruff format --check src/ tests/` — passed.

## Known Limitations

- The documentation exception is intentionally limited to Markdown and text files under recognized documentation paths; other file types and locations continue to use the stricter PE3 rule.

## References

- [GitHub PR #392](https://github.com/NVIDIA/SkillSpector/pull/392)