fix: enable only curated agent skills

hub/src/agent/runner.ts

@@ -151,7 +151,9 @@ export async function runAgent(req: RunRequest): Promise<RunResult> {
     type QueryOptions = NonNullable<Parameters<typeof query>[0]["options"]>;
     const options: QueryOptions = {
       cwd: security.cwd,
-      tools: [...toolConfig.tools],
+      // `skills` controls discovery/allowlisting, but an explicit `tools`
+      // list still has to expose the Skill dispatcher itself.
+      tools: [...toolConfig.tools, "Skill"],
       allowedTools: [...toolConfig.allowedTools],
       maxTurns: cap,
       includePartialMessages: true,
@@ -169,6 +171,7 @@ export async function runAgent(req: RunRequest): Promise<RunResult> {
       // The project workspace is untrusted input. Do not load user/project
       // settings that could widen tools, hooks, MCP servers, or sandbox paths.
       settingSources: [],
+      settings: { disableBundledSkills: true },
       plugins: [{ type: "local", path: security.skillPluginRoot, skipMcpDiscovery: true }],
       skills: [...security.skillIds],
       strictMcpConfig: true,