fix(license): give each file the copyright line of whoever wrote it

.claude/rules/license-compliance.md

@@ -24,7 +24,7 @@ The four §4 obligations, and what each means concretely here:
 | §4 | Obligation | State in this repository |
 |---|---|---|
 | (a) | Recipients get a copy of the License | `LICENSE` at the root, unmodified. **Never edit, relicense, or remove it**, and never change the NVIDIA copyright line inside it. |
-| (b) | Modified files carry prominent notices stating that You changed them | Enforced per file — see below. |
+| (b) | Modified files carry prominent notices stating that You changed them | Per file for anything carrying a comment header — see below. A build or documentation file with no comment syntax (`Makefile`, `pyproject.toml`, `README.md`, `docs/`) is covered instead by the Transparency bullet in `README.md`, which states that this fork modifies inherited files. Keep that bullet; it is the notice for everything a header cannot reach. |
 | (c) | Retain every copyright, patent, trademark and attribution notice from the Source form | Never delete an existing `SPDX-FileCopyrightText` line. Add beside it. |
 | (d) | Propagate a `NOTICE` file if the Work has one | Upstream ships **no** `NOTICE` — verified against `upstream/main`. Nothing to propagate. If upstream ever adds one, this row changes and the fork must carry it. |
 
@@ -52,16 +52,18 @@ regardless — the fork is Apache-2.0 too, and §4 offers no option to relicense
 inherited portions.
 
 **Do not copy a header "from any neighbour" without reading whose file it is.** That shortcut is how
-the current state arose: every one of the 128 files this fork authored carries NVIDIA's copyright
-line and nobody else's. `#95` carries the sweep that corrects it; until that lands, a new file still
-gets the *correct* header rather than matching its neighbours.
+the fork's headers went wrong in the first place: every file it authored carried NVIDIA's copyright
+line and nobody else's. `#95` swept the tree against `upstream/main` and corrected it — every
+fork-authored file given the fork's line alone, every inherited-and-modified file given both, every
+inherited-and-untouched file left as it is. `/license-audit` re-measures those three buckets, so ask
+it for the counts rather than reading a number here; the shortcut is what would put the tree back.
 
 ## Third-party dependencies
 
 `THIRD_PARTY_NOTICES.md` is upstream's record of the licenses the distribution pulls in. **A pull
 request that adds a runtime dependency to `pyproject.toml` adds its entry to that file in the same
-pull request.** The fork has already added `tree-sitter` and `tree-sitter-java` without doing so.
-Nothing enforces this — no CI job reads the file — so it is on the change author.
+pull request.** The fork's own additions — `tree-sitter` and `tree-sitter-java` — are recorded there
+as of `#95`. Nothing enforces this — no CI job reads the file — so it is on the change author.
 
 ## What never happens
 

.claude/skills/license-audit/SKILL.md

@@ -21,17 +21,23 @@ Three buckets, and every source file is in exactly one:
 
 ```bash
 MB=$(git merge-base upstream/main HEAD)
-git diff --name-only --diff-filter=A $MB HEAD -- src tests contrib   # fork-authored
-git diff --name-only --diff-filter=M $MB HEAD                        # inherited, modified here
+SCOPE="src tests contrib scripts"
+git diff --name-only --diff-filter=A $MB HEAD -- $SCOPE | xargs -r grep -l SPDX-FileCopyrightText
+git diff --name-only --diff-filter=M $MB HEAD -- $SCOPE | xargs -r grep -l SPDX-FileCopyrightText
 ```
 
 Anything with a header that appears in neither list is inherited and untouched.
 
+`scripts/` belongs in the scope — `scripts/release/` carries a header and an audit scoped to
+`src tests contrib` alone would miss it. Widen `$SCOPE` rather than dropping it: an unscoped `grep`
+matches the documentation *about* headers, `.claude/rules/license-compliance.md` and this file
+included, and counts prose as source.
+
 Pin `$MB` explicitly. A file upstream added *after* the merge-base and edited here classifies
 differently depending on the ref you diff against, and getting that backwards inverts the fix.
 
 **Done when** every file carrying an `SPDX-FileCopyrightText` line sits in exactly one bucket, and the
-three counts add up to `grep -rl "SPDX-FileCopyrightText" src/ tests/ contrib/ | wc -l`.
+three counts add up to `grep -rl SPDX-FileCopyrightText $SCOPE | wc -l`.
 
 ## 2. Audit the headers against the buckets
 
@@ -41,6 +47,11 @@ three counts add up to `grep -rl "SPDX-FileCopyrightText" src/ tests/ contrib/ |
 | Inherited, modified here | NVIDIA's line **and** the fork's, upstream first — §4(c) retains, §4(b) notices |
 | Fork-authored | the fork's line **only** |
 
+A modified file with **no comment syntax** — `Makefile`, `pyproject.toml`, `README.md`, anything under
+`docs/` — cannot carry a per-file notice at all. §4(b) for those is the Transparency bullet in
+`README.md` stating that this fork modifies inherited files. Check that the bullet is still there;
+do not invent a per-file mechanism for a file that has nowhere to put one.
+
 Every file keeps `SPDX-License-Identifier: Apache-2.0` and the Apache boilerplate regardless: §4 offers
 no option to relicense inherited portions, and the fork is Apache-2.0 too.
 

CLAUDE.md

@@ -115,7 +115,7 @@ whoever the user says. Do not manufacture an Umbrella Branch for a single PR.
 
 ## Critical Constraints
 
-- New source files need the SPDX + Apache-2.0 header block. **Do not copy one from a neighbour** — the copyright line depends on who wrote the file, and every neighbour carries NVIDIA's. See `.claude/rules/license-compliance.md`. Convention only; nothing enforces it.
+- New source files need the SPDX + Apache-2.0 header block. **Do not copy one from a neighbour** — the copyright line depends on who wrote the file, and a neighbour may be inherited, modified or fork-authored, each carrying a different line. See `.claude/rules/license-compliance.md`. Convention only; nothing enforces it.
 - `skillspector.constants` resolves the active provider and validates the model config **at import time**; importing it raises when `SKILLSPECTOR_STRICT_MODEL_VALIDATION=true` and a model is unknown.
 - This repo is a fork of NVIDIA/SkillSpector and still merges upstream. Prefer new files in new paths; where an existing file must change, keep the diff append-only.
 - Active goal: extend scanning to LangChain4j and Deep Agents skills. **Existing behavior on existing inputs must not change** — new analyzers are gated, never unconditionally wired.
@@ -193,3 +193,4 @@ When something fails repeatedly, when User has to re-explain, or when a workarou
 - `sole_argument` returns `None` for zero *and* multi-argument calls alike.
 - Snapshot counts rot in prose; write "every committed snapshot", never a number.
 - `--repo-scan`/`--recursive` differences are a README table; update it, not just code.
+- Copyright headers: classify by `git diff --diff-filter` against the merge-base, never by path.

README.md

@@ -332,6 +332,14 @@ The complete variable table is in [Environment Variables](#environment-variables
   this fork tracks it and merges from it. Issues with this fork belong
   [here](https://github.com/rodrigorjsf/SkillSpector-Polyglot/issues), not upstream.
 - **License unchanged.** Apache-2.0, as upstream. See [LICENSE](LICENSE).
+- **This fork has modified files it inherited from upstream, and added files of its own.** That
+  sentence is the Apache-2.0 §4(b) notice for the distribution as a whole, and it covers the build
+  and documentation files — `README.md`, `Makefile`, `pyproject.toml`, `THIRD_PARTY_NOTICES.md`,
+  `docs/` — that have no comment syntax to carry one. Every *source* file says so for itself: a file
+  this fork changed carries NVIDIA's copyright line with the fork's beneath it, and a file this fork
+  wrote carries the fork's line only. Read the header to know who wrote a source file; run
+  `git diff <merge-base> HEAD` against upstream to know exactly what changed. Dependencies this fork
+  added are recorded in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md) beside upstream's.
 - **The detection rates quoted in the Overview are upstream's research**, reproduced as inherited
   documentation. This fork has not independently reproduced them.
 - **Known limits are stated, not hidden.** Static analysis matches patterns and cannot prove intent;

THIRD_PARTY_NOTICES.md

@@ -66,6 +66,18 @@ and project URL.
 - **Copyright:** Copyright (c) LangChain, Inc.
 - **URL:** https://github.com/langchain-ai/langchain
 
+### tree-sitter
+
+- **License:** MIT
+- **Copyright:** Copyright (c) 2019 Max Brunsfeld, GitHub
+- **URL:** https://github.com/tree-sitter/py-tree-sitter
+
+### tree-sitter-java
+
+- **License:** MIT
+- **Copyright:** Copyright (c) 2017 Ayman Nadeem
+- **URL:** https://github.com/tree-sitter/tree-sitter-java
+
 ### yara-python
 
 - **License:** Apache-2.0

contrib/vocabulary_sweep/__init__.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

contrib/vocabulary_sweep/__main__.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

contrib/vocabulary_sweep/maven_sweep.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

contrib/vocabulary_sweep/published.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

contrib/vocabulary_sweep/pypi_sweep.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

contrib/vocabulary_sweep/report.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

contrib/vocabulary_sweep/roles.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

contrib/vocabulary_sweep/tests/test_readers.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/cli.py

@@ -1,4 +1,5 @@
 # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/deepagents/__init__.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/deepagents/host_config.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/deepagents/signals.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/deepagents/skill_sources.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/deepagents/subagents.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/deepagents/vocabulary.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/deepagents/writability.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/framework.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/input_handler.py

@@ -1,4 +1,5 @@
 # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/inspection_ledger.py

@@ -1,4 +1,5 @@
 # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 
 """Typed contracts and safe factories for inspection-work accounting."""

src/skillspector/langchain4j/__init__.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/langchain4j/builder_chains.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/langchain4j/java_parser.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/langchain4j/shell_skills.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/langchain4j/signals.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/langchain4j/skill_definitions.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/langchain4j/tool_surface.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/langchain4j/vocabulary.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/llm_analyzer_base.py

@@ -1,4 +1,5 @@
 # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/manifest_status.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/nodes/analyzers/__init__.py

@@ -1,4 +1,5 @@
 # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/nodes/analyzers/behavioral_ast.py

@@ -1,4 +1,5 @@
 # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/nodes/analyzers/behavioral_taint_tracking.py

@@ -1,4 +1,5 @@
 # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/nodes/analyzers/framework_deepagents.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/nodes/analyzers/framework_langchain4j.py

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/nodes/analyzers/mcp_least_privilege.py

@@ -1,4 +1,5 @@
 # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/nodes/analyzers/mcp_rug_pull.py

@@ -1,4 +1,5 @@
 # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/nodes/analyzers/mcp_tool_poisoning.py

@@ -1,4 +1,5 @@
 # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

src/skillspector/nodes/analyzers/pattern_defaults.py

@@ -1,4 +1,5 @@
 # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2026 SkillSpector-Polyglot contributors
 # SPDX-License-Identifier: Apache-2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");