feat: add curated curriculum agent skills

2026-07-11 12:22:01 +08:00
parent 1a892ccb54
commit 96e120e02c
28 changed files with 1785 additions and 6 deletions
@@ -122,6 +122,14 @@ The boundary is enforced by the Claude Code SDK's built-in sandbox
 - `settingSources: []` and strict MCP configuration prevent an untrusted
  workspace or service-user config from widening tools, hooks, MCP servers, or
  sandbox paths.
+- Platform-curated Agent skills are immutable Hub release assets, loaded as a
+  programmatic local plugin from a release-owned path. The sandbox exposes that
+  path read-only, and the SDK receives only plugin-qualified allowlist names
+  through its `skills` option. Filesystem setting sources remain disabled, so a
+  project cannot register another skill or widen its tools through `.claude`
+  settings. Requested skill ids are recorded on `run.created`; SDK
+  initialization/results remain the authoritative evidence that loading
+  actually succeeded.
 - Network: open (see Open Questions).

 `bypassPermissions` is kept (headless server — no interactive prompts); the