fix: add validation for built-in skills in message handlers

Author: hannesrudolph

src/core/webview/skillsMessageHandler.ts

@@ -44,6 +44,11 @@ export async function handleCreateSkill(
 			throw new Error(t("skills:errors.missing_create_fields"))
 		}
 
+		// Built-in skills cannot be created
+		if (source === "built-in") {
+			throw new Error(t("skills:errors.cannot_modify_builtin"))
+		}
+
 		const skillsManager = provider.getSkillsManager()
 		if (!skillsManager) {
 			throw new Error(t("skills:errors.manager_unavailable"))
@@ -82,6 +87,11 @@ export async function handleDeleteSkill(
 			throw new Error(t("skills:errors.missing_delete_fields"))
 		}
 
+		// Built-in skills cannot be deleted
+		if (source === "built-in") {
+			throw new Error(t("skills:errors.cannot_modify_builtin"))
+		}
+
 		const skillsManager = provider.getSkillsManager()
 		if (!skillsManager) {
 			throw new Error(t("skills:errors.manager_unavailable"))
@@ -114,6 +124,11 @@ export async function handleOpenSkillFile(provider: ClineProvider, message: Webv
 			throw new Error(t("skills:errors.missing_delete_fields"))
 		}
 
+		// Built-in skills cannot be opened as files (they have no file path)
+		if (source === "built-in") {
+			throw new Error(t("skills:errors.cannot_open_builtin"))
+		}
+
 		const skillsManager = provider.getSkillsManager()
 		if (!skillsManager) {
 			throw new Error(t("skills:errors.manager_unavailable"))

src/core/webview/webviewMessageHandler.ts

@@ -2245,10 +2245,9 @@ export const webviewMessageHandler = async (
 					const yamlContent = await fs.readFile(fileUri[0].fsPath, "utf-8")
 
 					// Import the mode with the specified source level
-					const result = await provider.customModesManager.importModeWithRules(
-						yamlContent,
-						message.source || "project", // Default to project if not specified
-					)
+					// Note: "built-in" is not a valid source for importing modes
+					const importSource = message.source === "global" ? "global" : "project"
+					const result = await provider.customModesManager.importModeWithRules(yamlContent, importSource)
 
 					if (result.success) {
 						// Update state after importing

src/i18n/locales/en/skills.json

@@ -9,6 +9,8 @@
 		"missing_create_fields": "Missing required fields: skillName, source, or skillDescription",
 		"manager_unavailable": "Skills manager not available",
 		"missing_delete_fields": "Missing required fields: skillName or source",
-		"skill_not_found": "Skill \"{{name}}\" not found"
+		"skill_not_found": "Skill \"{{name}}\" not found",
+		"cannot_modify_builtin": "Built-in skills cannot be created or deleted",
+		"cannot_open_builtin": "Built-in skills cannot be opened as files"
 	}
 }