Allow arbitrary resource subdirectories per AgentSkills.io spec

The spec allows any additional files and directories, not just
references/, scripts/, and assets/. Replace the hardcoded allowlist
in ResourcePath with a check that the path is in any subdirectory.
Safety rules remain: no path traversal, no absolute paths, no bare
filenames at the root level.

Author: Aaronontheweb

src/SkillServer/Endpoints.cs

@@ -239,7 +239,7 @@ private static async Task<IResult> UploadSkill(
                     return Results.BadRequest(new ErrorResponse
                     {
                         Error = "invalid_resource_path",
-                        Message = $"Invalid resource path: '{resourceFile.FileName}'. Must be in references/, scripts/, or assets/ directories."
+                        Message = $"Invalid resource path: '{resourceFile.FileName}'. Must be a relative path in a subdirectory with no path traversal."
                     });
                 }
 

src/SkillServer/Models/ValueObjects.cs

@@ -144,8 +144,6 @@ public static Sha256Digest FromHex(string hexValue)
 /// </summary>
 public readonly record struct ResourcePath
 {
-    private static readonly string[] AllowedPrefixes = ["references/", "scripts/", "assets/"];
-
     public string Value { get; }
 
     private ResourcePath(string value) => Value = value;
@@ -157,15 +155,13 @@ public static bool TryCreate(string? value, [NotNullWhen(true)] out ResourcePath
         if (string.IsNullOrWhiteSpace(value))
             return false;
 
-        // No path traversal
         if (value.Contains("..") || value.StartsWith('/') || value.StartsWith('\\'))
             return false;
 
-        // Normalize separators
         var normalized = value.Replace('\\', '/');
 
-        // Must be in allowed directories
-        if (!AllowedPrefixes.Any(p => normalized.StartsWith(p, StringComparison.OrdinalIgnoreCase)))
+        // Must be in a subdirectory — bare filenames at the root are not resources
+        if (!normalized.Contains('/') || normalized.IndexOf('/') == normalized.Length - 1)
             return false;
 
         result = new ResourcePath(normalized);
@@ -175,7 +171,7 @@ public static bool TryCreate(string? value, [NotNullWhen(true)] out ResourcePath
     public static ResourcePath Create(string value)
     {
         if (!TryCreate(value, out var result))
-            throw new ArgumentException($"Invalid resource path: '{value}'. Must be in references/, scripts/, or assets/ directories with no path traversal.", nameof(value));
+            throw new ArgumentException($"Invalid resource path: '{value}'. Must be a relative path in a subdirectory with no path traversal.", nameof(value));
         return result.Value;
     }
 

tests/SkillServer.Tests/ValueObjectTests.cs

@@ -115,10 +115,12 @@ public sealed class ResourcePathTests
     [InlineData("scripts/setup.sh", true)]
     [InlineData("assets/logo.png", true)]
     [InlineData("references/deep/nested/file.md", true)]
+    [InlineData("custom/file.txt", true)]
+    [InlineData("examples/demo.py", true)]
     [InlineData("../secret.txt", false)]
     [InlineData("/etc/passwd", false)]
-    [InlineData("SKILL.md", false)] // Must be in allowed directories
-    [InlineData("random/file.txt", false)]
+    [InlineData("SKILL.md", false)] // Bare filenames are not resources
+    [InlineData("justadirectory/", false)]
     [InlineData("", false)]
     public void TryCreate_ValidatesCorrectly(string input, bool expectedValid)
     {