Module skill 

The skill tool: level 2 of progressive disclosure.

Every enabled skill’s name and description already ride in the system prompt. This is how the model gets the body — the actual procedure — and it is a tool call rather than a cat for four reasons, all of them mecha’s rather than the standard’s:

• shell may be sandboxed, or withheld entirely. A loading mechanism that depends on it stops working in exactly the configurations that were locked down on purpose.
• A tool call passes the pre_tool gate, so a policy hook can decide which skills may load. A cat is invisible to hooks.
• It lands in the trace, so an eval case can assert on it and sessions health can count it. A silent context injection is the thing Datadog named as defeating every downstream defence.
• The model does not have to know where the filesystem keeps things.

It arms no taint, and that is the point

A skill body is user-authored — there is no install verb, no remote fetch, and nothing here is ever written by a model. So it is the user’s own words, exactly like the system prompt, and this tool declares Capabilities::default and returns ToolOutput::ok rather than from_outside. Marking it untrusted would be a category error in the direction that makes a model invent explanations for its own harness — the same mistake as labelling a harness refusal as third-party content. See crate::skill for the provenance argument this rests on.

Structs

SkillTool

Loads skill bodies, and remembers which it has loaded.