fix: apply extension/shebang filter to single-file targets

src/scan.js

@@ -28,7 +28,12 @@ export function collectFiles(target) {
   const out = [];
   const st = existsSync(target) ? statSync(target) : null;
   if (!st) return out;
-  if (st.isFile()) { out.push(target); return out; }
+  if (st.isFile()) {
+    const name = basename(target);
+    const e = extname(name).toLowerCase();
+    if (CODE_EXT.has(e) || TEXT_EXT.has(e) || (e === "" && hasShebang(target))) out.push(target);
+    return out;
+  }
   const walk = (dir) => {
     for (const name of readdirSync(dir)) {
       if (SKIP_DIR.has(name)) continue;

test/skill-audit.test.js

@@ -101,6 +101,13 @@ test("clean skill produces zero findings", () => {
   assert.equal(findings.length, 0, JSON.stringify(findings, null, 2));
 });
 
+test("single-file binary targets are not collected for scanning", () => {
+  const binary = fixture("binary-target.bin");
+  assert.deepEqual(collectFiles(binary), []);
+  assert.equal(scanSkill(binary).files, 0);
+  assert.deepEqual(scanSkill(binary).findings, []);
+});
+
 test("extensionless shebang scripts are scanned while plain files stay ignored", () => {
   const root = fixture("extensionless-shebang-skill");
   const files = collectFiles(root);