57 lines
3.1 KiB
Markdown
57 lines
3.1 KiB
Markdown
# Row 64 probe: how a managed session gets its skills (2026-10-19)
|
|
|
|
Sage, 18:50Z to 18:53Z. Claude Code 2.1.303 (`~/.local/bin/claude`), pi
|
|
from the pinned `@earendil-works/pi-coding-agent`. Every Claude Code run
|
|
was a short `-p` with `--model haiku`, in an empty workspace, with
|
|
`--restricted --strict-mcp-config --mcp-config '{"mcpServers":{}}'
|
|
--permission-mode dontAsk --debug-file <log>` and a probe plug-in passed
|
|
as `--plugin-dir plug`:
|
|
|
|
```
|
|
plug/.claude-plugin/plugin.json {"name":"mosaic-skills",...}
|
|
plug/skills/probe-alpha/SKILL.md name probe-alpha; "The probe word is ZEBRA-4471."
|
|
```
|
|
|
|
The operator's own `~/.claude/skills` holds the ms-* skills, so a leak
|
|
would have shown up.
|
|
|
|
## Claude Code
|
|
|
|
| Run | Tools | Settings | Skills offered | Result |
|
|
|---|---|---|---|---|
|
|
| A | `--tools ""` | none | none | model: "I don't see any skills". Debug: `Loaded 1 skills from plugin mosaic-skills`, `user: 0` |
|
|
| B | `--tools Skill` | none | 14: probe-alpha plus Claude Code's own (loop, run, update-config, init, claude-api, dataviz, ...) | read the skill, printed ZEBRA-4471 |
|
|
| C1 | `--tools Skill` | `disableBundledSkills`, `disableSkillShellExecution` | 2: probe-alpha, plugin-authoring | |
|
|
| C2 | `--tools Skill` | env `CLAUDE_CODE_DISABLE_BUNDLED_SKILLS=1` | 2: same | |
|
|
| D | `--tools Skill` | C1 plus `skillOverrides: {"plugin-authoring": "off"}` | 1: probe-alpha | printed ZEBRA-4471. Debug still: `getSkills returning: ... 2 bundled skills, 1 builtin plugin skills`, `Sending 1 skills via attachment` |
|
|
| E | as D | as D | asked to call plugin-authoring, loop, update-config, run, init, claude-api, dataviz | all 7 refused at validation (`Skill tool validation error: code=7` twice, `code=2` five times); none loaded |
|
|
|
|
What it shows:
|
|
- `--restricted` keeps user skills out (`user: 0` in every run).
|
|
- A `--plugin-dir` skill works only with the `Skill` tool on. With it on,
|
|
"only the contracted skills" holds only through settings that name
|
|
Claude Code's own skills (`plugin-authoring`), and two bundled skills
|
|
stay loaded under names the log doesn't give. That list belongs to the
|
|
Claude Code version.
|
|
- The `Skill` tool would be a new built-in on `--tools`, so the gate hook
|
|
(PreToolUse `*`) would see it.
|
|
|
|
## Pi
|
|
|
|
`docs/skills.md:67-69` in the pinned package: at startup pi puts each
|
|
skill's name and description in the prompt, and "when a task matches, the
|
|
agent uses `read`, or `bash` when `read` is unavailable, to load the full
|
|
SKILL.md". `packages/harness/src/gate.mjs:3-4`: "every path argument of a
|
|
file tool must resolve inside the workspace". The bundle is in the run
|
|
directory, outside the workspace, so a `--skill` copy can't be read.
|
|
|
|
## Choice
|
|
|
|
The skill text goes into `prompt.md` on both harnesses, rendered from the
|
|
bundle copies. Pi keeps `--no-skills`, Claude Code keeps
|
|
`--disable-slash-commands` and `--restricted`. Neither harness discovers a
|
|
skill, nothing new passes the gate, and the manifest's digests cover what
|
|
the model reads. The cost is the skill text in every turn's prompt: by
|
|
`wc -c` over the repo's `skills/` copies, coder 16.9 KB, reviewer 16.3 KB,
|
|
cto 35.9 KB, pm 29.1 KB.
|