static-analysis: files over 1 MB are dropped silently — the skill neither raises --max-target-bytes nor reports the skip

What

Semgrep skips any file larger than --max-target-bytes (default 1,000,000) and the JSON output carries no trace of it: no paths.skipped entry, no error, just an empty scanned list. The semgrep skill never raises the limit and never mentions it — not as a flag in run-scans.sh, not in SKILL.md, not in references/scan-modes.md.

The result is a scan that reports 0 findings for a file it never opened, which is indistinguishable from a file that is clean.

Reproduction

cd /tmp
printf 'function f(){ document.write("<b>"+location.hash+"</b>"); }\n' > big.js
python3 -c "open('big.js','a').write(('// ' + 'padding to push this file past one megabyte '*2 + chr(10))*11000)"
wc -c big.js     # 1012060

semgrep --metrics=off --config p/javascript --json /tmp/big.js | jq -c '.paths, {results: (.results|length)}'

Actual:

{"scanned":[]}
{"results":0}

No skipped key, no errors, zero results. The same file with the limit raised:

semgrep --metrics=off --max-target-bytes 5000000 --config p/javascript --json /tmp/big.js \
  | jq -c '{scanned:(.paths.scanned|length), results:[.results[].check_id]}'

{"scanned":1,"results":["javascript.browser.security.raw-html-concat.raw-html-concat"]}

A real XSS finding, invisible in the first run.

The reason is only reachable through --verbose, which the skill does not use:

Skipped by limiting to files smaller than 1000000 bytes:
(Adjust with the --max-target-bytes flag)
 • /tmp/big.js

Impact

scans.json records findings: 0 and a filesScanned count that excludes the dropped file, so nothing downstream can tell the difference between "scanned and clean" and "never opened". This hits exactly the codebases where a security scan matters most: large single-file bundles, legacy monoliths, generated or vendored files. Any one file over 1 MB drops out of every ruleset at once.

Success criterion 8 in SKILL.md says a scan whose rulesets covered nothing must be reported. This is the same class of silent gap, and it is not currently detectable from the JSON.

Suggested fix

Either of these would close it; the first is a one-liner:

1. Pass an explicit, configurable limit in build_argv, e.g. ARGV+=(--max-target-bytes "${SEMGREP_MAX_TARGET_BYTES:-20000000}").
2. Surface the skipped-by-size files in scans.json so they show up in the report the way failed and skipped already do — and note the limit in scan-modes.md.

Verified against semgrep 1.176.1.