pvs skill: harden credentials parsing; note compile DB is exported by default

- Parse PVS_STUDIO_CREDENTIALS into two quoted fields (no glob/word-split).
- AGENTS.md: examples build sets CMAKE_EXPORT_COMPILE_COMMANDS ON already.

Addresses Copilot review on #3695.

2 files changed, 6 insertions, 3 deletions

diff --git a/.claude/skills/pvs/run_pvs.sh b/.claude/skills/pvs/run_pvs.sh
index d8604b697..7406a3b4f 100755
--- a/.claude/skills/pvs/run_pvs.sh
+++ b/.claude/skills/pvs/run_pvs.sh
@@ -39,8 +39,10 @@ JOBS="$(nproc 2>/dev/null || echo 4)"
 if ! pvs-studio-analyzer lic-info >/dev/null 2>&1; then
   if [ -n "${PVS_STUDIO_CREDENTIALS:-}" ]; then
     echo ">>> Registering PVS-Studio license from PVS_STUDIO_CREDENTIALS"
-    # shellcheck disable=SC2086 # credentials expects two whitespace-separated args
-    pvs-studio-analyzer credentials $PVS_STUDIO_CREDENTIALS
+    # Split "<name> <key>" into exactly two fields, quoted, so a key containing
+    # glob chars or extra spaces can't be word-split/expanded.
+    read -r _pvs_name _pvs_key <<< "$PVS_STUDIO_CREDENTIALS"
+    pvs-studio-analyzer credentials "$_pvs_name" "$_pvs_key"
   else
     echo "ERROR: no PVS-Studio license found and PVS_STUDIO_CREDENTIALS is unset." >&2
     exit 1
diff --git a/AGENTS.md b/AGENTS.md
index c26887425..69efe916a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -153,7 +153,8 @@ Reports land in `cmake-metrics/<board>/metrics_compare.md` (per-board) and `cmak
 
 ## Static Analysis (PVS-Studio)
 
-Requires `compile_commands.json` (CMake `-DCMAKE_EXPORT_COMPILE_COMMANDS=ON`). The
+Requires `compile_commands.json`, which the examples build exports by default
+(`hw/bsp/family_support.cmake` sets `CMAKE_EXPORT_COMPILE_COMMANDS ON`). The
 `pvs` skill (`.claude/skills/pvs/SKILL.md`) wraps the build + analyze flow for a
 board; the commands below are the underlying steps.