trust only same-scope skill dependencies

Author: charlesvien

packages/ui/src/features/loops/hooks/useLoopSkillBundles.ts

@@ -42,7 +42,7 @@ async function buildSkillUploads(
     throw new Error(
       `The ${skill.name} skill references /${untrusted.name}, which resolved to a skill ` +
         `outside its own scope (${untrusted.source}: ${untrusted.path}). Install ` +
-        `${untrusted.name} as one of your user skills, or alongside ${skill.name}, and retry.`,
+        `${untrusted.name} alongside ${skill.name} and retry.`,
     );
   }
   const ordered = [skill, ...dependencies];

packages/ui/src/features/loops/loopSkill.test.ts

@@ -26,9 +26,20 @@ describe("isTrustedSkillDependency", () => {
 
   it.each([
     {
-      name: "user dependency is always trusted",
+      name: "user dependency of a repo skill is rejected",
+      // A repository's SKILL.md controls dependency names; trusting user skills
+      // here would let it exfiltrate the user's private machine-level skills.
       dep: { source: "user" as const, path: "/home/me/.claude/skills/helper" },
       primary: repoPrimary,
+      expected: false,
+    },
+    {
+      name: "user dependency of a user skill is trusted",
+      dep: { source: "user" as const, path: "/home/me/.claude/skills/helper" },
+      primary: {
+        source: "user" as const,
+        path: "/home/me/.claude/skills/deploy-checks",
+      },
       expected: true,
     },
     {

packages/ui/src/features/loops/loopSkill.ts

@@ -55,17 +55,17 @@ function parentDir(skillPath: string): string {
 
 /**
  * Whether a resolved skill dependency may ride along in a loop's bundle set.
- * The resolver matches dependencies by name across every local skill, so a
- * same-named skill in another opened repository could otherwise shadow the
- * real dependency and get itself installed into every recurring run. Trusted:
- * the user's own machine-level skills, and siblings from the same skills
- * directory as the skill that referenced them.
+ * Dependency names come from the referencing skill's SKILL.md, which for a repo
+ * skill is repository-controlled — so only same-source siblings from the same
+ * skills directory are trusted. Anything looser leaks: a cross-directory match
+ * lets another repo shadow the dependency, and trusting user skills from a repo
+ * primary would let a repository declare likely user-skill names and silently
+ * upload the user's private machine-level skills.
  */
 export function isTrustedSkillDependency(
   dep: { source: LoopSchemas.LoopSkillSourceEnum; path: string },
   primary: { source: LoopSchemas.LoopSkillSourceEnum; path: string },
 ): boolean {
-  if (dep.source === "user") return true;
   return (
     dep.source === primary.source &&
     parentDir(dep.path) === parentDir(primary.path)