xuhdandClaude Opus 4.7
e54f42c0eb
Even after the previous owner check, the agent could still patch/edit a UI-uploaded skill (source=upload) it happened to own. Uploaded skills represent human-reviewed content; letting the agent rewrite them risks silent drift from what the user approved. Add _assert_skill_is_agent_authored which reads usage.json and refuses unless source==agent. Wired into all five write actions (create/edit/patch/delete/write_file/remove_file). Skills with no usage entry default to source=upload, so legacy and adopted-orphan skills are also refused — only skills the agent created via mark_agent_created in the create flow stay editable. Note: this check is independent of skill_store availability (it reads the usage file, not the DB), so it runs even when skill_store is None. Tests that exercise non-create paths against pre-existing skills will need to call mark_agent_created first or mock get_entry. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>