fix(analyzer): deduplicate PE4 findings per line to avoid double-reporting

A line such as `docker.DockerClient(base_url="unix:///var/run/docker.sock")`
matched both the `DockerClient(` and `/var/run/docker.sock` PE4 patterns,
producing two findings for the same vulnerability on the same line.

Collect PE4 candidates in a dict keyed by line number, keeping only the
highest-confidence match, then extend the findings list once. Adds a
regression test that asserts exactly one PE4 finding on such a combined line.

Addresses nit raised in review of PR NVIDIA#189.

Signed-off-by: CharmingGroot <hogeun.choi@vicsnc.com>
Signed-off-by: CharmingGroot <ohyes9711@gmail.com>

Author: CharmingGroot

src/skillspector/nodes/analyzers/static_patterns_privilege_escalation.py

@@ -162,24 +162,28 @@ def loc(ln: int) -> Location:
                     matched_text=match.group(0)[:200],
                 )
             )
+    # Collect best-confidence PE4 finding per line to avoid double-counting lines
+    # that match multiple patterns (e.g. DockerClient(base_url=".../docker.sock")).
+    pe4_best: dict[int, AnalyzerFinding] = {}
     for pattern, confidence in PE4_PATTERNS:
         for match in re.finditer(pattern, content, re.IGNORECASE | re.MULTILINE):
             line_num = get_line_number(content, match.start())
             context = get_context(content, match.start())
             if _is_documentation_example(context, file_type):
                 continue
-            findings.append(
-                AnalyzerFinding(
-                    rule_id="PE4",
-                    message="Docker Socket Access",
-                    severity=Severity.HIGH,
-                    location=loc(line_num),
-                    confidence=confidence,
-                    tags=tag,
-                    context=context,
-                    matched_text=match.group(0)[:200],
-                )
+            if line_num in pe4_best and pe4_best[line_num].confidence >= confidence:
+                continue
+            pe4_best[line_num] = AnalyzerFinding(
+                rule_id="PE4",
+                message="Docker Socket Access",
+                severity=Severity.HIGH,
+                location=loc(line_num),
+                confidence=confidence,
+                tags=tag,
+                context=context,
+                matched_text=match.group(0)[:200],
             )
+    findings.extend(pe4_best.values())
     return findings
 
 

tests/nodes/analyzers/test_static_patterns.py

@@ -354,6 +354,23 @@ def test_pe4_docker_sock_path_produces_finding(self):
         assert pe4[0].context is not None
         assert pe4[0].matched_text is not None
 
+    def test_pe4_combined_line_produces_exactly_one_finding(self):
+        """A line matching multiple PE4 patterns must produce exactly one PE4 finding."""
+        state = {
+            "components": ["skill.py"],
+            "file_cache": {
+                "skill.py": 'client = docker.DockerClient(base_url="unix:///var/run/docker.sock")\n',
+            },
+        }
+        findings = static_runner.run_static_patterns(state, [privilege_escalation_module])
+        pe4 = [f for f in findings if f.rule_id == "PE4"]
+        assert len(pe4) == 1, (
+            f"Expected 1 PE4 finding, got {len(pe4)}: {[f.matched_text for f in pe4]}"
+        )
+        assert (
+            pe4[0].confidence == 0.9
+        )  # /var/run/docker.sock has higher confidence than DockerClient(
+
     def test_pe4_docker_from_env_produces_finding(self):
         """docker.from_env() yields PE4 (HIGH)."""
         state = {
@@ -406,11 +423,7 @@ def test_pe4_documentation_example_not_flagged(self):
             "components": ["SKILL.md"],
             "file_cache": {
                 "SKILL.md": (
-                    "# Docker SDK\n\n"
-                    "For example:\n"
-                    "```python\n"
-                    "client = docker.from_env()\n"
-                    "```\n"
+                    "# Docker SDK\n\nFor example:\n```python\nclient = docker.from_env()\n```\n"
                 ),
             },
         }