[777genius]

Problem

An isolated JSON field such as "VERSION": "1.0.0", is extracted as a local file reference. This creates a spurious missing-reference record for JSON metadata, including the example in asc-workflow/SKILL.md described in #1021.

Change

Exclude only the version value span of a complete uppercase JSON VERSION field line containing a three-component numeric version and an optional trailing comma. Other keys, malformed versions, explicit Markdown destinations, numeric filenames, and interpreter script operands retain their existing reference behavior.

This changes extraction only. It does not change missing-reference reporting policy, coverage limits, path containment checks, or safety recommendations directly.

Validation

• On the unchanged base, the new regression file reports 5 failures and 9 passes; the failures reproduce the JSON metadata bug in both the resolver and no-LLM CLI.
• After the fix, the focused reference suites pass: 153 tests.
• make format, make lint, and make format-check pass.
• Full make test unit phase: 19,634 passed, 24 skipped, 4 xfailed, 2 failed. Both failures use the hardcoded /nonexistent/path/xyz; this host denies access to /nonexistent, producing PermissionError rather than the expected missing-path error. They reproduce on the unchanged upstream base.
• Ran make test-integration separately because make test stopped at the unit failures: 248 passed, 5 skipped, 1 failed. The remaining failure has the same /nonexistent cause and also reproduces on the unchanged base.
• These host-specific failures remain disclosed; upstream CI is still required. No test was removed, skipped, or changed to hide them.
• The contribution includes SPDX headers and a DCO sign-off.

Related: #524 / #525 concern YAML frontmatter. This contribution is limited to JSON field classification. A separate v2.13.3 backport is available in the fork; no Registry scanner or profile is changed by this PR.

Fixes #1021

Refs 777genius/universal-agent-plugins-registry#411

Upstream GitHub CI passed all six jobs for commit c47f9fa831a7221645234f4adbdbf3446248bbf3: changes, lint, test-unit, OpenCode TypeScript Tests, DCO Check, and docker-smoke. Run: https://github.com/NVIDIA/SkillSpector/actions/runs/41914583925.

[yashrajp22]

I completed an independent source review and adjudicated Greptile's completed review of 1cd5a1d to c47f9fa. The new matcher has a resource-bounds issue, and one regression assertion can accept the wrong reference record.

This is a source-only review: I have not run tests, builds, scans, installed-wheel checks, corpus verification, or provider calls. The backtracking finding is based on source analysis; no runtime timing measurements or full verification are claimed.

[777genius]

Thank you, ready.