@@ -0,0 +1,35 @@
+# AS3 current-skill references
+
+AS3 detects access to other installed skills. A literal reference to the
+currently selected skill, such as `skills/example-skill/SKILL.md`, is excluded
+when the scanner can establish that skill's identity from the selected input.
+
+Input resolution preserves one identity through temporary materialization:
+
+| Selected input | Identity |
+| --- | --- |
+| Local skill directory | Resolved directory basename |
+| Git repository | Repository basename from the successfully cloned input URL |
+| Local `SKILL.md` file | Original file's absolute parent directory basename |
+| Archive with one outer skill directory | Preserved outer directory basename |
+| Flat local ZIP archive | Selected archive filename without `.zip` |
+
+For example, a flat `example-skill.zip` containing `SKILL.md` with
+`name: example-skill` retains that identity after extraction to a temporary
+`extracted` directory. A `download.zip` containing an `example-skill/` directory
+uses the contained directory name. The archive filename does not become a
+second identity for a preserved skill directory.
+
+The manifest name must agree with the selected identity when present. It does
+not independently authorize suppression: changing `name` to a peer skill's
+name must not hide references to that peer. Case and underscore/hyphen variants
+remain distinct. Obfuscated paths, explicit enumeration, AS1, and AS2 retain
+their existing detection behavior. Filtering happens before finding budgets
+and inspection-ledger emission.
+
+An arbitrary externally renamed staging directory, an ambiguous direct-download
+URL, or a flat downloaded archive may lack enough provenance to establish the
+skill name. Such inputs retain AS3 findings. URL path segments can represent
+repository names or slash-containing Git refs, so they are not guessed as
+skill aliases. Integrations should preserve the selected skill-directory name
+or supply the original supported input to the scanner.
@@ -709,6 +709,56 @@ def _validate_zip_member_type(info: zipfile.ZipInfo) -> None:
         raise ValueError("Zip directory entry contains file data")
 
 
+def selected_source_identity_for_input(
+    input_path: str,
+    *,
+    source_type: str,
+    resolved_path: Path,
+    temp_dir: Path | None,
+) -> str | None:
+    """Identify the selected skill without treating materialization names as aliases.
+
+    Call only after successful input resolution, using the source type and
+    temporary directory returned by that handler. A preserved archive root is
+    stronger evidence than the archive filename; neither introduces a second
+    identity. Unknown source layouts deliberately have no suppression identity.
+    """
+    if source_type == "directory":
+        return resolved_path.name or None
+
+    if source_type == "git":
+        text = input_path.strip()
+        if text.startswith("git@"):
+            match = re.fullmatch(r"git@[^:]+:(.+)", text)
+            if match is None:
+                return None
+            source_path = match.group(1)
+        else:
+            source_path = urlparse(text).path
+        return source_path.rstrip("/").rsplit("/", 1)[-1].removesuffix(".git") or None
+
+    if temp_dir is None:
+        return None
+
+    extraction_root = temp_dir / "extracted"
+    if source_type in {"zip", "url"} and resolved_path.parent == extraction_root:
+        # InputHandler preserves a unique outer directory from an archive.
+        return resolved_path.name or None
+    if source_type == "zip" and resolved_path == extraction_root:
+        return Path(input_path.strip()).stem or None
+
+    if source_type == "file":
+        original = Path(input_path.strip())
+        if original.name not in {"SKILL.md", "skill.md"}:
+            return None
+        return Path(os.path.abspath(original)).parent.name or None
+
+    # Direct-download URLs cannot reliably distinguish repository, slash-
+    # containing ref, and skill-directory segments. Keep those identities
+    # unknown rather than allowing a ref or repository name to hide a peer.
+    return None
+
+
 class InputHandler:
     """
     Handles input resolution for different source types.
 
@@ -235,7 +235,30 @@ def _normalize_skill_identifier(value: object) -> str | None:
 def _current_skill_identifiers(state: SkillspectorState) -> frozenset[str]:
     """Derive a trusted, internally consistent current-skill identity."""
 
-    skill_path: object = state.get("skill_path")
+    # Normal graph scans carry one resolver-owned source identity, including
+    # an explicit None when the input layout is ambiguous. Direct analyzer
+    # callers retain the scan-root fallback used before provenance existed.
+    if "selected_source_identity" in state:
+        path_identifier = _normalize_skill_identifier(state.get("selected_source_identity"))
+    else:
+        path_identifier = _scan_root_identifier(state.get("skill_path"))
+
+    manifest = state.get("manifest")
+    manifest_identifier: str | None = None
+    if isinstance(manifest, Mapping):
+        manifest_identifier = _normalize_skill_identifier(manifest.get("name"))
+
+    # Manifest data can corroborate the selected source but cannot override a
+    # disagreement or add an alias that could conceal access to a peer skill.
+    if path_identifier is None:
+        return frozenset()
+    if manifest_identifier is not None and manifest_identifier != path_identifier:
+        return frozenset()
+    return frozenset({path_identifier})
+
+
+def _scan_root_identifier(skill_path: object) -> str | None:
+    """Return the root basename for callers without resolved input provenance."""
     path_text: str | bytes | None = None
     if isinstance(skill_path, str):
         path_text = skill_path
@@ -249,19 +272,7 @@ def _current_skill_identifiers(state: SkillspectorState) -> frozenset[str]:
         normalized_path = path_text.replace("\\", "/").rstrip("/")
         path_identifier = _normalize_skill_identifier(normalized_path.rsplit("/", 1)[-1])
 
-    manifest = state.get("manifest")
-    manifest_identifier: str | None = None
-    if isinstance(manifest, Mapping):
-        manifest_identifier = _normalize_skill_identifier(manifest.get("name"))
-
-    # The path is the only host-derived identity available here.  A manifest
-    # name is contributor-controlled, so it may corroborate the path but must
-    # never introduce a second identity or override a disagreement.
-    if path_identifier is None:
-        return frozenset()
-    if manifest_identifier is not None and manifest_identifier != path_identifier:
-        return frozenset()
-    return frozenset({path_identifier})
+    return path_identifier
 
 
 def _is_current_skill_path_reference(
 
@@ -27,6 +27,7 @@
 from skillspector.input_handler import (
     InputHandler,
     TransitiveIngestTruncatedError,
+    selected_source_identity_for_input,
     validate_local_input_path,
 )
 from skillspector.logging_config import get_logger
@@ -58,11 +59,17 @@ def resolve_input(state: SkillspectorState) -> dict[str, object]:
         handler = InputHandler(transitive_budget=workflow_budget)
         try:
             resolved, source_type = handler.resolve(input_path.strip())
+            temp_dir = handler.temp_dir_for_cleanup()
             update: dict[str, object] = {
                 "skill_path": str(resolved),
+                "selected_source_identity": selected_source_identity_for_input(
+                    input_path.strip(),
+                    source_type=source_type,
+                    resolved_path=resolved,
+                    temp_dir=temp_dir,
+                ),
                 "workflow_resource_budget": workflow_budget,
             }
-            temp_dir = handler.temp_dir_for_cleanup()
             if temp_dir is not None:
                 update["temp_dir_for_cleanup"] = str(temp_dir)
             else:
@@ -87,19 +94,22 @@ def resolve_input(state: SkillspectorState) -> dict[str, object]:
             resolved = validate_local_input_path(Path(skill_path))
             return {
                 "skill_path": str(resolved),
+                "selected_source_identity": resolved.name or None,
                 "temp_dir_for_cleanup": None,
                 "workflow_resource_budget": workflow_budget,
             }
         except (OSError, RuntimeError) as e:
             logger.warning("Could not resolve skill_path: %s", e)
             return {
                 "skill_path": None,
+                "selected_source_identity": None,
                 "temp_dir_for_cleanup": None,
                 "workflow_resource_budget": workflow_budget,
             }
 
     return {
         "skill_path": None,
+        "selected_source_identity": None,
         "temp_dir_for_cleanup": None,
         "workflow_resource_budget": workflow_budget,
     }
@@ -236,6 +236,10 @@ class SkillspectorState(TypedDict, total=False):
     # Input: resolve_input node consumes input_path or skill_path, sets skill_path
     input_path: str | None
     skill_path: str | None
+    # Set/reset by resolve_input from the actual selected source. None means
+    # materialization could not establish a current-skill identity; analyzers
+    # must not substitute generated directory names or manifest-only aliases.
+    selected_source_identity: str | None
     # Set by resolve_input when a temp dir was created (git/url/zip/file); caller should clean up
     temp_dir_for_cleanup: str | None
     zip_bytes: bytes | None
 
@@ -895,20 +895,67 @@ def test_as3_scan_root_identity_marks_self_reference_when_manifest_is_absent(sel
         assert readme_event["emitted_finding_ids"] == []
         assert not any(f.rule_id == "AS3" for f in result["findings"])
 
-    def test_as3_inconsistent_manifest_identity_fails_closed(self):
-        """A contributor-controlled manifest cannot override the scan-root identity."""
+    def test_as3_selected_source_identity_suppresses_temp_clone_self_reference(self):
+        """Temp-clone basename ``repo`` still suppresses when source identity corroborates."""
         state = {
-            "skill_path": "/tmp/checkout-root",
+            "skill_path": "/tmp/skillspector_abc123/repo",
+            "selected_source_identity": "example-skill",
             "manifest": {"name": "example-skill"},
             "components": ["README.md"],
             "file_cache": {"README.md": "Root skill: skills/example-skill/SKILL.md"},
         }
 
         result = agent_snooping_module.node(state)
 
+        readme_event = next(
+            event for event in result["inspection_ledger"] if event["path"] == "README.md"
+        )
+        assert readme_event["outcome"] == "completed"
+        assert readme_event["emitted_finding_ids"] == []
+        assert not any(f.rule_id == "AS3" for f in result["findings"])
+
+    def test_as3_inconsistent_manifest_identity_fails_closed(self):
+        """Conflicting root and manifest identities cannot authorize suppression."""
+        state = {
+            "skill_path": "/tmp/checkout-root/example-skill",
+            "manifest": {"name": "published-name"},
+            "components": ["README.md"],
+            "file_cache": {
+                "README.md": (
+                    "Root skill: skills/example-skill/SKILL.md\n"
+                    "Also: skills/published-name/SKILL.md\n"
+                    "Peer: skills/other-skill/SKILL.md"
+                )
+            },
+        }
+
+        result = agent_snooping_module.node(state)
+
         as3_findings = [finding for finding in result["findings"] if finding.rule_id == "AS3"]
         assert [finding.matched_text for finding in as3_findings] == [
-            "skills/example-skill/SKILL.md"
+            "skills/example-skill/SKILL.md",
+            "skills/published-name/SKILL.md",
+            "skills/other-skill/SKILL.md",
+        ]
+
+    def test_as3_adversarial_mismatched_manifest_does_not_suppress_peer_path(self):
+        """Malicious manifest name unequal to trusted source identity cannot hide AS3."""
+        state = {
+            "skill_path": "/tmp/skillspector_abc123/repo",
+            "selected_source_identity": "evil-skill",
+            "manifest": {"name": "victim"},
+            "components": ["README.md"],
+            "file_cache": {
+                "README.md": ("Self: skills/evil-skill/SKILL.md\nPeer: skills/victim/SKILL.md")
+            },
+        }
+
+        result = agent_snooping_module.node(state)
+
+        as3_findings = [finding for finding in result["findings"] if finding.rule_id == "AS3"]
+        assert [finding.matched_text for finding in as3_findings] == [
+            "skills/evil-skill/SKILL.md",
+            "skills/victim/SKILL.md",
         ]
 
     def test_as3_long_current_skill_path_is_not_snooping(self):