Problem: "Skipping analyzer semantic_developer_intent: required API key is missing" — is config broken? —— Trove problem library

What you will run into

skillspector --version or scan outputs WARNING [skillspector.graph] Skipping analyzer semantic_developer_intent: required API key is missing.

You think config is broken or functionality is incomplete — actually auto-skipping without a key is normal behavior, not an error.

Why this happens

LLM semantic analyzers need OPENAI_API_KEY (or SKILLSPECTOR_PROVIDER config) to run; without a key they auto-skip with a single WARNING:

The warning doesn't affect the exit code or report generation (measured here: 3 semantic-skip warnings, exit 0, scan normal).

skillspector's scanner is a two-tier architecture: rule detection (YARA/patterns) runs locally and depends on no external service;

semantic analysis (semantic_*) calls an LLM — it asks a large model to judge "does this skill content have malicious intent", and calling the LLM needs an API key.

The behavior without a key is degradation, not error: the scanner detects the missing key, skips the semantic analyzers, prints a WARNING, and finishes the rule detection.

That's the standard design of optional dependencies: core functionality (rule detection) doesn't depend on external services; enhanced functionality (semantic analysis) activates by availability.

A WARNING is not an error — the exit code and the report generate normally; the report just lacks the semantic-analysis dimension.

Judging "is the scan complete" also has a fixed criterion: see what the WARNING says (was the skipped item an enhancement or a core item) — skipping semantic analysis doesn't affect the rule-detection conclusions, but if you depend on semantic analysis (e.g.

judging malicious intent), configure the key first and rescan.

Step by step

1. Without a key: static scanning is fully usable — Required

skillspector scan <target dir> --no-llm

Rule detection (YARA/patterns) doesn't depend on the LLM; it still detects what it detects.

2. For semantic analysis: set the key — Required

export OPENAI_API_KEY=your-key

Or set SKILLSPECTOR_PROVIDER per the project docs.

3. The warning is safe to ignore — Required

WARNING doesn't affect the exit code or report generation; --version and scan keep working (measured exit 0).

How to confirm it works

Scan completes normally (measured output shape):

skillspector scan <dir>
→ 3 semantic-skip warnings + normal scan results, exit 0

Or with the key set, warnings disappear and semantic analyzers join scoring.

Other environments

Symptom

skillspector --version / scan outputs:

WARNING [skillspector.graph] Skipping analyzer semantic_developer_intent: required API key is missing

Cause

LLM semantic analyzers need OPENAI_API_KEY (or SKILLSPECTOR_PROVIDER config); without a key they are skipped automatically — this is not an error.

Solution

1. No key needed: static scanning is fully usable (--no-llm); rule detection (YARA/patterns) does not depend on LLM.
2. For semantic analysis: set the OPENAI_API_KEY env var or configure SKILLSPECTOR_PROVIDER per the docs.
3. The warnings can be safely ignored; they do not affect the exit code or report generation.

Verified install / uninstall in this marketplace (2026-08-28)

• Install (manifest install.cmd, isolated venv /tmp/l34-sp/venv, Python 3.14.4): curl -sL wheel (gh-proxy, 468K) -> pip install -i Tsinghua mirror skillspector-2.10.0-py3-none-any.whl; deps boto3/httpx/langchain-*/langgraph/openai/pydantic/yara-python (source build succeeded) etc. 60+ packages -> SkillSpector v2.10.0 (3 semantic skip warnings, exit 0) -> install exit=0.
• Uninstall (manifest uninstall.cmd + fixed verify): pip uninstall -y skillspector -> Successfully uninstalled skillspector-2.10.0 -> verify zero leftovers exit 0.
• local repro log; PyPI-missing check:; scan smoke: (constructed sample detected 2 HIGH, read-only scan confirmed).
• Not tested: MCP server mode real run, LLM semantic analysis (no API key), baseline command.

Conflict notes

• possible-compatible (inferred): all recorded entries — skillspector is read-only scanning (zero new files before/after scan), no daemon, no config write surface, no ports; the CLI surface coexists with any entry with no shared write surface (matrix pairs).
• Note: LLM semantic analysis sharing the API key env var with other tools is a config-surface note (not a write-surface conflict).

Name confusion

• Casing: project SkillSpector (NVIDIA open source), command skillspector.
• Channel: no PyPI package (see Symptom 1); search/install by the GitHub repo NVIDIA/SkillSpector and release assets.
• Distinct from other skill-security/checker tools (e.g. agent-skills skill packs, different function).