fix(ai): enforce snake_case validation on skill/tool name references

- SkillSchema.tools now validates snake_case pattern for tool name references
- AgentSchema.skills now validates snake_case pattern for skill name references
- Added tests for snake_case enforcement on both references

Agent-Logs-Url: https://github.com/objectstack-ai/spec/sessions/5cefdc4a-fa65-4b56-876d-3ca34809f7b3

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Author: Copilot

packages/spec/src/ai/agent.test.ts

@@ -285,6 +285,32 @@ describe('AgentSchema', () => {
       const result = AgentSchema.parse(agent);
       expect(result.permissions).toEqual(['agent.basic', 'data.read']);
     });
+
+    it('should enforce snake_case for skill name references', () => {
+      expect(() => AgentSchema.parse({
+        name: 'test_agent',
+        label: 'Test',
+        role: 'Test',
+        instructions: 'Test',
+        skills: ['valid_skill', 'another_skill'],
+      })).not.toThrow();
+
+      expect(() => AgentSchema.parse({
+        name: 'test_agent',
+        label: 'Test',
+        role: 'Test',
+        instructions: 'Test',
+        skills: ['InvalidSkill'],
+      })).toThrow();
+
+      expect(() => AgentSchema.parse({
+        name: 'test_agent',
+        label: 'Test',
+        role: 'Test',
+        instructions: 'Test',
+        skills: ['valid_skill', 'Invalid-Skill'],
+      })).toThrow();
+    });
   });
 
   describe('Access Control', () => {

packages/spec/src/ai/agent.zod.ts

@@ -137,7 +137,7 @@ export const AgentSchema = z.object({
   lifecycle: StateMachineSchema.optional().describe('State machine defining the agent conversation follow and constraints'),
 
   /** Capabilities — Skill-based (primary) */
-  skills: z.array(z.string()).optional().describe('Skill names to attach (Agent→Skill→Tool architecture)'),
+  skills: z.array(z.string().regex(/^[a-z_][a-z0-9_]*$/)).optional().describe('Skill names to attach (Agent→Skill→Tool architecture)'),
 
   /** Capabilities — Direct tool references (fallback / legacy) */
   tools: z.array(AIToolSchema).optional().describe('Direct tool references (legacy fallback)'),

packages/spec/src/ai/skill.test.ts

@@ -114,6 +114,26 @@ describe('SkillSchema', () => {
     });
     expect(result.instructions).toContain('knowledge base');
   });
+
+  it('should enforce snake_case for tool name references', () => {
+    expect(() => SkillSchema.parse({
+      name: 'valid_skill',
+      label: 'Test',
+      tools: ['valid_tool', 'another_tool'],
+    })).not.toThrow();
+
+    expect(() => SkillSchema.parse({
+      name: 'valid_skill',
+      label: 'Test',
+      tools: ['InvalidTool'],
+    })).toThrow();
+
+    expect(() => SkillSchema.parse({
+      name: 'valid_skill',
+      label: 'Test',
+      tools: ['valid_tool', 'Invalid-Tool'],
+    })).toThrow();
+  });
 });
 
 describe('defineSkill', () => {

packages/spec/src/ai/skill.zod.ts

@@ -71,7 +71,7 @@ export const SkillSchema = z.object({
    * References to tool names that belong to this skill.
    * Tools must be registered as first-class metadata (type: 'tool').
    */
-  tools: z.array(z.string()).describe('Tool names belonging to this skill'),
+  tools: z.array(z.string().regex(/^[a-z_][a-z0-9_]*$/)).describe('Tool names belonging to this skill'),
 
   /**
    * Natural language phrases that trigger skill activation.