Scoped npm package specs are misclassified as unresolved local references #528

Summary

SkillSpector 2.11.2 treats the xerg/cli substring inside a scoped npm package spec as an unresolved local path. The scan has zero findings and LOW risk, but analysis_completeness.is_complete becomes false and the final recommendation is downgraded to CAUTION.

Minimal reproducer

SKILL.md:

---
name: repro
description: Minimal reference-resolution reproducer.
---

Run `npx --yes @xerg/[email protected] doctor --json` after approval.

Command:

skillspector scan ./repro --format json --output report.json --no-llm

Observed with SkillSpector v2.11.2 from commit 69dcdfb74487d361ba4c811d088cfdea2ff3a9dc:

{
  "execution_successful": true,
  "risk_assessment": {
    "score": 0,
    "severity": "LOW",
    "recommendation": "CAUTION",
    "max_issue_severity": "NONE"
  },
  "issues": [],
  "analysis_completeness": {
    "is_complete": false,
    "status": "partial",
    "execution_successful": true,
    "ledger_exceptions": [
      {
        "phase": "reference_resolution",
        "reason_code": "reference_unresolved",
        "path": "SKILL.md",
        "start_line": 6,
        "end_line": 6,
        "fatal": false
      }
    ],
    "references": [
      {
        "source_path": "SKILL.md",
        "line": 6,
        "column": 17,
        "evidence": "Run `npx --yes @xerg/[email protected] doctor --json` after approval.",
        "target_path": null,
        "status": "missing",
        "disposition": "partial"
      }
    ]
  }
}

The same resolver also appears to classify ordinary slash-separated prose such as reading/analyzing as path candidates.

Expected behavior

Scoped npm specs and ordinary slash-separated prose should not be treated as local file references. A zero-finding scan should remain complete unless a genuine bundle reference cannot be inspected.

Why baselines do not help

This is completeness accounting, not a finding. A baseline can suppress issues but cannot restore analysis_completeness.is_complete.