Sensitive credential path detection can be bypassed through path construction

[2002lcy0401]

Summary

With LLM analysis explicitly disabled (--no-llm), the scanner detects a literal /etc/passwd path but fails when the same path is constructed using os.path.join().

Scan command:

skillspector scan .\xxx --no-llm -f json

Original:

with open('/etc/passwd', 'r') as f:
    passwd_data = f.read()

Result:

PE3 - Credential Access
Severity: HIGH
Finding: /etc/passwd

Variant:

import os

path = os.path.join('/etc', 'passwd')

with open(path) as f:
    passwd_data = f.read()

Result:

No security issues detected.

Expected Behavior

Both variants should trigger the same credential-access finding because the constructed path resolves statically to /etc/passwd.

Impact

Without LLM analysis, simple path construction completely bypasses the PE3 credential-access detection.

Suggested Fix

Add static constant propagation and path resolution for expressions such as os.path.join() before matching sensitive paths.