v2.12.0

# SkillSpector v2.12.0

Published September 23, 2026.

## Summary

SkillSpector 2.12.0 improves skill analysis, report consistency, scan visibility, and performance. It adds OpenCode integrations, more flexible repository inputs, expanded model configuration, and optional CI controls. The release also includes security hardening, bug fixes, and reliability improvements.

## Highlights

- Improved analysis accuracy and more consistent reporting of scan completeness.
- Better finding identity, source locations, and machine-readable reports.
- Faster scanning and interactive progress that keeps report output separate from status messages.
- OpenCode integration and expanded provider and model configuration guidance.
- GitHub subdirectory scanning and direct GitHub/GitLab file-link support.
- Additional regression coverage and portability improvements.

## Features and usability

- Add the optional `opencode_cli` provider and a repository-provided OpenCode command and tool.
- Support selected GitHub `/tree/` subdirectories using advertised branches or tags. Arbitrary commit-SHA tree URLs are not supported by this selection path. GitHub/GitLab `/blob/` links are processed as file contents.
- Add the opt-in `--fail-on-findings` CLI flag and a configurable per-artifact static-analysis allowance.
- Show progress and discovered files on standard error during non-verbose interactive scans. JSON and SARIF report output remains on standard output.
- Add sanitized LLM configuration and execution provenance to JSON reports. Provenance describes the recorded configuration and execution; it does not guarantee deterministic provider results.
- Add optional compact prompt line numbering, updated model-budget metadata, and Gemini 3.5 Flash setup guidance for the existing OpenAI-compatible provider.
- Improve recursive reporting and finding locations in JSON and SARIF.
- Retry eligible transient provider failures within the workflow deadline. Additional requests and backoff can affect latency and provider cost.

## Upgrade and compatibility notes

- Findings, risk scores, recommendations, and completeness results can change after upgrading. Review existing baselines and downstream report handling.
- Use supported inputs and UTF-8 instruction files. Unsupported required input or execution errors may return exit code 2. Input-size and complexity limits continue to apply.
- `--fail-on-findings` is opt-in. Combine it with `--fail-on-incomplete` when CI must reject either active findings or incomplete coverage. A policy-gate failure returns code 1; code 2 denotes an input or execution error. Exit code 0 alone does not establish complete inspection.
- Report consumers should tolerate additive metadata and diagnostic fields, preserve completeness and omission information, and handle occurrence-specific locations. JSON columns are zero-based; SARIF columns are one-based Unicode-codepoint positions. Unavailable columns remain unknown.
- Reference diagnostics distinguish `reference_missing` from `reference_unresolved`. MCP consumers must check completeness separately: an eligible installation result may still carry missing-reference caveats. Retain eligibility, completeness, and recommendation fields together.
- The default static-analysis allowance increases from 30 to 300 seconds per artifact, still bounded by the workflow deadline. Set `SKILLSPECTOR_MAX_STATIC_ANALYSIS_SECONDS_PER_ARTIFACT=30` to retain the previous allowance, and restart the process after changing it.
- OpenCode semantic analysis is opt-in and requires an authenticated OpenCode **1.18.31** installation. Install the native OpenCode integration by copying `.opencode/` from a checkout; it is not installed by the Python wheel. The native tool defaults to static analysis. Configure the provider and set `noLlm=false` when requesting semantic analysis. Token-usage accounting is not currently available for `opencode_cli`.
- Pi extension users must use the extension's `.venv` or configure `SKILLSPECTOR_BIN` as an existing absolute executable path, and keep report outputs within the current workspace. These requirements are specific to the Pi extension.
- CLI providers now honor valid `SKILLSPECTOR_MODEL_REGISTRY` token-budget overrides. LLM seeds must fit a signed 64-bit integer. Optional compact prompt numbering is enabled with `SKILLSPECTOR_COMPACT_PROMPTS`; existing formatting remains the default.
- Use `--no-llm` for an intended static-only scan. Requested analysis that cannot run remains visible in completeness metadata.
- Third-party dependency versions are unchanged from 2.11.2. No deprecations are introduced in this release.

## Validation and scope

Regression coverage and cross-platform test fixtures were expanded. Scan results remain bounded by the supported inputs, configured analyzers, and recorded resource limits. Incomplete inspection remains a reportable outcome.

Provider availability, model behavior, and deployment compatibility depend on the configured environment and require environment-specific validation. Publication of this release does not establish that every provider, platform, or downstream deployment has been qualified.

Prepared by Codex on behalf of Mohit Gupta.