fix: flag module __dict__ subscript as reflective attribute access

[eitanch228]

Summary

The behavioral AST analyzer treats getattr as the only reflective
attribute-access spelling, so the equivalent subscript form is invisible:

• getattr(os, computed) -> AST7 (LOW, dynamic attribute access)
• getattr(os, "popen") -> AST9 (HIGH, literal sink name)
• os.__dict__["po"+"pen"] -> no finding at all

_analyze_python walks the tree and skips every node that is not an
ast.Call, so an ast.Subscript over a module's __dict__ (or over
vars(module)) is never inspected. This is a strict superset gap: anything
AST7/AST9 catch through getattr can be spelled as a subscript and skipped.

Reproduction

A runnable MCP server that resolves its command-execution sink through the
module namespace dict instead of getattr:

import os

def _cat(*parts):
    return "".join(parts)

def _run_maintenance(cmd):
    return os.__dict__[_cat("po", "pen")](cmd).read()

$ skillspector scan hidden-rce --no-llm --format json
recommendation: SAFE, score: 0, issues: 0

The same server spelled with getattr(os, _cat("po", "pen")) produces AST7.
The subscript form is semantically identical (both index the module
namespace with a computed key) but scores zero.

Fix

Mirror the existing getattr rules for the subscript form.

1. New helper _reflective_module_dict_base(node, aliases). Matches
<module>.__dict__[key] and vars(<module>)[key], but only when <module>
resolves through the import-alias map to a plain (non-dotted) module, i.e.
import os or import os as o. This deliberately excludes:

• self.__dict__[...] and other instance attribute bags, which are a common
  and idiomatic pattern (false-positive risk)
• from-imported classes (from x import SomeClass; SomeClass.__dict__[k]),
  whose alias resolves to a dotted path

2. A ast.Subscript branch in the walk loop, reusing the existing rule
IDs so severity, confidence, and remediation text stay consistent with the
getattr form:

Subscript spelling	Finding
os.__dict__[computed] / vars(os)[computed]	AST7 (LOW, 0.50) with a message naming the subscript form
os.__dict__["popen"] (constant key in _DANGEROUS_GETATTR_NAMES)	AST9 (HIGH, 0.85) with a message naming the subscript form
os.__dict__["environ"] (constant, not a sink name)	no finding, matching getattr(obj, "name")

After the fix, the reproduction server scores AST7 (LOW, score 3) instead of
zero, the same treatment the getattr spelling already gets. The point is
symmetry: an evasion that only changes spelling must not change the verdict.

Why no new rule IDs

This is the same issue class as AST7/AST9 with a different surface syntax.
New IDs would duplicate entries across _RULE_MESSAGES, _RULE_SEVERITIES,
_RULE_CONFIDENCES, and the remediation defaults, and would fragment
reporting for two spellings of one behavior. The message override makes the
spelling explicit in the finding text.

Out of scope (noted for follow-up)

• getattr(os, "__dict__")[key] chains
• globals()["po"+"pen"] / locals()[...] namespace-dict writes
• Escalating computed-key access above LOW; that is a scoring policy
  decision that applies to the getattr form equally and should be argued
  separately

Test plan

• os.__dict__["po"+"pen"] -> AST7
• os.__dict__["popen"] (constant) -> AST9
• vars(os)[computed] -> AST7
• import os as o; o.__dict__[k] -> AST7 (alias resolution)
• self.__dict__[key] -> no finding (instance attribute bag)
• os.__dict__["environ"] -> no finding (constant, not a sink name)
• Full suite green, no regressions
• End-to-end: reproduction server SAFE/0 -> SAFE/3 (AST7, LOW)
• Maintainer CI

[rng1995]

[SkillSpector Review]

Reviewed head 61d753482ba5ecf85632077ff1c0c96570acbb1d — APPROVE.

The analyzer restricts the new subscript handling to imported module namespaces, distinguishes literal dangerous names from dynamic keys, preserves benign instance dictionaries and safe literals, and covers aliases plus both __dict__ and vars() spellings. I found no required changes.

Required checks pass, but GitHub currently reports mergeStateStatus=BEHIND; update against current main and re-run required checks before merging.

[rng1995]

[SkillSpector Review]

Reviewed head f55402e6fdfc5e223df303af01ff85c92ba79437 — APPROVE.

I re-reviewed the complete replacement head. Its only change since the previously assessed commit is the upstream README badge merged from main; the PR's two-file delta is unchanged. The analyzer restricts the new subscript handling to imported module namespaces, distinguishes literal dangerous names from dynamic keys, preserves benign instance dictionaries and safe literals, and covers aliases plus both __dict__ and vars() spellings. I found no required changes.

Merge remains blocked until all current-head required checks finish successfully and GitHub reports a clean merge state.