feat: add curated curriculum agent skills

hub/src/agent/security.ts

@@ -1,6 +1,7 @@
 import { chmod, lstat, mkdir, realpath } from "node:fs/promises";
 import { homedir } from "node:os";
 import { isAbsolute, join, relative, resolve } from "node:path";
+import { validateCuratedSkillPlugin } from "./curatedSkills.js";
 
 const PROVIDER_ENV_KEYS = new Set([
   "ANTHROPIC_BASE_URL",
@@ -60,6 +61,8 @@ export interface AgentSecurityPolicy {
   readonly cwd: string;
   readonly workspaceRoot: string;
   readonly env: Record<string, string | undefined>;
+  readonly skillIds: readonly string[];
+  readonly skillPluginRoot: string;
   readonly sandbox: AgentSandboxPolicy;
 }
 
@@ -79,6 +82,7 @@ export async function createAgentSecurityPolicy(input: AgentSecurityInput): Prom
   const agentState = await ensureDirectoryTree(runtimeRoot, ["state"]);
   const agentTmp = await ensureDirectoryTree(cphRoot, ["t"]);
   assertShortAgentTemp(agentTmp);
+  const skillPlugin = await validateCuratedSkillPlugin();
 
   const path = hostEnv["PATH"]?.trim();
   if (path === undefined || path === "") {
@@ -119,6 +123,8 @@ export async function createAgentSecurityPolicy(input: AgentSecurityInput): Prom
     cwd: workspaceDir,
     workspaceRoot,
     env,
+    skillIds: skillPlugin.skillIds,
+    skillPluginRoot: skillPlugin.root,
     sandbox: {
       enabled: true,
       failIfUnavailable: true,
@@ -134,7 +140,7 @@ export async function createAgentSecurityPolicy(input: AgentSecurityInput): Prom
         // workspace plus the named system runtime needed to execute tools.
         // SDK allowRead takes precedence over matching denyRead paths.
         denyRead: ["/"],
-        allowRead: [workspaceDir, ...runtimeReadPaths],
+        allowRead: [workspaceDir, skillPlugin.root, ...runtimeReadPaths],
       },
       credentials: {
         files: sensitiveReadPaths.map((path) => ({ path, mode: "deny" as const })),