fix(analyzers): rely on runner for example filtering in E5 and TM4 (close executable bypass)

[CharmingGroot]

Summary

The SC7 review (#224) established that calling is_code_example() inside an analyzer with an unconditional continue lets a nearby example marker suppress findings in executable files — the shared runner already filters examples in non-executable docs and only downweights executables, so the analyzer-level call is redundant and opens an attacker-controlled bypass. E5 (#218) and TM4 (#220), both merged, use the same pattern. This applies the same fix.

Changes

• static_patterns_data_exfiltration.py (E5): drop the is_code_example call and import; rely on the runner's file-type-aware handling.
• static_patterns_tool_misuse.py (TM4): same.
• Tests: TM4's analyze-level doc-exclusion test is replaced with an executable-evasion test (# for example next to privileged: true still fires); an equivalent E5 regression is added.

Why this is safe

Detection is unchanged — the runner still suppresses non-executable docs and downweights executables. Only the bypass is closed: a # for example near s3.put_object(...) or privileged: true in a .sh/.py no longer evades E5/TM4. anti_refusal already uses a confidence penalty (not a skip), so it is intentionally left as-is.

Testing

make format and make lint pass; the full suite reports 1256 passed, 0 failed. A re-scan confirms detection is preserved (E5 ×2, TM4 ×6 still fire on the same fixtures).

Follows up on the review in #224.

[rng1995]

[Automated SkillSpector Review]

Approved. Removing analyzer-level is_code_example() suppression from E5/TM4 correctly restores the shared runner’s file-type-aware policy: non-executable examples remain filtered, while executable examples are only downweighted and can no longer evade detection. Focused regressions cover both rules. The current CI format failure is in unchanged mcp_least_privilege.py, not this diff.

[rng1995]

Fix linting please @CharmingGroot

[rng1995]

@CharmingGroot - Please address review comments and resolve merge conflicts.

[CharmingGroot]

Rebased onto current main — conflict in src/skillspector/nodes/analyzers/static_patterns_data_exfiltration.py resolved by keeping main's expanded common imports minus is_code_example (removed by this PR). No remaining is_code_example call sites in E5/TM4.

The mcp_least_privilege.py format failure was fixed on main and cleared with the rebase. make lint / make format-check pass, unit suite 2187 passed / 16 skipped. Ready to merge.

[rng1995]

[SkillSpector Review]

Approved. E5/TM4 no longer apply an analyzer-local example hard-drop; the shared runner remains the single policy point, preserving documentation filtering while closing executable-file bypasses. Required CI is green.