feat: subprocess provider, SQLite LLM cache, meta-analyzer batching, and scan UX improvements

.env.example

@@ -28,6 +28,22 @@ ANTHROPIC_PROXY_API_KEY=
 # ANTHROPIC_PROXY_API_VERSION=vertex-2023-10-16                 # optional; defaults to vertex-2023-10-16
 # SKILLSPECTOR_SSL_VERIFY=false                                 # set to false for internal/self-signed CAs
 
+# ---------------------------------------------------------------------------
+# subprocess provider  (SKILLSPECTOR_PROVIDER=subprocess)
+# ---------------------------------------------------------------------------
+# Routes every LLM prompt through a shell command via stdin.
+# Use this when running SkillSpector inside Claude Code, OpenClaw, Antigravity,
+# or any other AI-tool session where the AI is the session itself.
+#
+# Examples:
+#   SKILLSPECTOR_LLM_COMMAND=claude -p          # Claude Code
+#   SKILLSPECTOR_LLM_COMMAND=antigravity ask    # Antigravity
+#   SKILLSPECTOR_LLM_COMMAND=openclaw chat      # OpenClaw
+#
+# The prompt is written to the command's stdin; the response is read from stdout.
+# No API key is required — the session AI handles the call.
+SKILLSPECTOR_LLM_COMMAND=
+
 # SkillSpector config
 SKILLSPECTOR_MODEL=                                             # leave empty to use the active provider's bundled default (see README); set to override (e.g. gpt-5.2)
 # SKILLSPECTOR_MODEL_REGISTRY=./model_registry.yaml             # optional override; defaults to each provider's bundled YAML in src/skillspector/providers/

.skillspector-baseline.yaml

@@ -0,0 +1,5 @@
+# SkillSpector baseline — findings listed here are suppressed on future scans.
+# Edit 'reason' fields and add glob 'rules' as needed. See docs/SUPPRESSION.md.
+version: 1
+rules: []
+fingerprints: []

docs/DEVELOPMENT.md

@@ -34,8 +34,8 @@ make install-dev
 
 - **Python**: 3.12+ (see [pyproject.toml](../pyproject.toml)). `make install` and `make install-dev` use **uv** if available (`uv sync` / `uv sync --all-extras`), otherwise **pip** (`pip install -e .` / `pip install -e ".[dev]"`). You must create and activate the virtual environment yourself before running any make target.
 - **Environment**: Optional `.env` in the project root. The LangGraph dev server loads it (see [langgraph.json](../langgraph.json) `"env": ".env"`). Key variables:
-  - **`SKILLSPECTOR_PROVIDER`**: Selects the active LLM provider — `openai`, `anthropic`, or `nv_build`. Defaults to `nv_build` when unset.
-  - **Provider credential**: depends on the active provider — `NVIDIA_INFERENCE_KEY` (NVIDIA), `OPENAI_API_KEY` (OpenAI), or `ANTHROPIC_API_KEY` (Anthropic). See [llm_utils.py](../src/skillspector/llm_utils.py).
+  - **`SKILLSPECTOR_PROVIDER`**: Selects the active LLM provider — `openai`, `anthropic`, `anthropic_proxy`, `nv_build`, or `subprocess`. Defaults to `nv_build` when unset.
+  - **Provider credential**: depends on the active provider — `NVIDIA_INFERENCE_KEY` (NVIDIA), `OPENAI_API_KEY` (OpenAI), `ANTHROPIC_API_KEY` (Anthropic), or `SKILLSPECTOR_LLM_COMMAND` (subprocess — no API key required; routes prompts through a shell command). See [llm_utils.py](../src/skillspector/llm_utils.py).
   - **`OPENAI_BASE_URL`**: Override the OpenAI endpoint (e.g. point at Ollama).
   - **`SKILLSPECTOR_MODEL`**: Override default model; see [constants.py](../src/skillspector/constants.py).
 
@@ -265,11 +265,12 @@ Copy [.env.example](../.env.example) to `.env` in the project root and set value
 
 | Variable | Description | Example |
 |----------|-------------|---------|
-| `SKILLSPECTOR_PROVIDER` | Active LLM provider: `openai` \| `anthropic` \| `nv_build` \| `claude_cli` \| `codex_cli`. Defaults to `nv_build`. | `claude_cli` |
+| `SKILLSPECTOR_PROVIDER` | Active LLM provider: `openai` \| `anthropic` \| `anthropic_proxy` \| `nv_build` \| `subprocess` \| `claude_cli` \| `codex_cli`. Defaults to `nv_build`. | `openai` |
 | `NVIDIA_INFERENCE_KEY` | Credential for `nv_build`. | `nvapi-...` |
 | `OPENAI_API_KEY` | Credential for `SKILLSPECTOR_PROVIDER=openai`. Also tier-2 fallback for non-OpenAI providers. | `sk-...` |
 | `OPENAI_BASE_URL` | Override the OpenAI endpoint (e.g. point at Ollama). | `http://localhost:11434/v1` |
 | `ANTHROPIC_API_KEY` | Credential for `SKILLSPECTOR_PROVIDER=anthropic`. | `sk-ant-...` |
+| `SKILLSPECTOR_LLM_COMMAND` | Shell command for `SKILLSPECTOR_PROVIDER=subprocess`. Prompt is piped via stdin; response read from stdout. No API key needed — the current AI session handles the call. | `claude -p` |
 | `SKILLSPECTOR_MODEL` | Override the active provider's bundled default model (see [README.md](../README.md) for per-provider defaults). For `claude_cli`, this is passed as `--model` to the `claude` binary. | `gpt-5.2` |
 
 > **CLI providers** (`claude_cli`, `codex_cli`): no credential env var is needed. Authentication is managed by the agent CLI's own session (`claude auth login` / `codex login`). The subprocess is heavily sandboxed — see [providers/_agent_cli.py](../src/skillspector/providers/_agent_cli.py).

docs/PI_EXTENSION.md

@@ -43,7 +43,7 @@ Equivalent CLI:
 - `format`: `terminal`, `json`, `markdown`, or `sarif`. Default: `terminal`.
 - `output`: optional report path.
 - `noLlm`: default `true`.
-- `provider`: optional `openai`, `anthropic`, `anthropic_proxy`, `nv_build`, or `nv_inference`.
+- `provider`: optional `openai`, `anthropic`, `anthropic_proxy`, `nv_build`, `nv_inference`, or `subprocess`.
 - `model`: optional model override.
 - `yaraRulesDir`: optional directory of extra YARA rules.
 - `verbose`: optional detailed progress.