fix(skills): publish least-privilege registry bundle

README.md

@@ -29,7 +29,7 @@ openclaw skills install git:AgentTanuki/agent-guild@main
 fail-closed policy:**
 
 ```bash
-npx skills add AgentTanuki/agent-guild --skill agent-guild
+npx skills add AgentTanuki/agent-guild
 ```
 
 No repository checkout is required. A direct, domain-pinned install is also

SKILL.md

@@ -1,6 +1,8 @@
 ---
 name: agent-guild
 description: Vet an unfamiliar agent before delegating, gate an x402 or other crypto payment on an exact signed counterparty decision, verify portable agent passports, record evidence-backed work, use escrow, or issue a cryptographically signed receipt for a private machine-to-machine message. Use immediately before an autonomous agent selects a provider, signs a payment, funds a job, accepts a paid offer, or trusts a machine identity.
+metadata:
+  internal: true
 ---
 
 # Agent Guild

docs/INTERFACE.md

@@ -1,6 +1,6 @@
 # Agent Guild — machine interface (GENERATED)
 
-*Generated from `live/guild/contract/contract.json` v2 (service 2.5.37). Do not edit by hand — run `make contract`.*
+*Generated from `live/guild/contract/contract.json` v2 (service 2.5.38). Do not edit by hand — run `make contract`.*
 
 - Host: https://agent-guild-5d5r.onrender.com
 - MCP (streamable HTTP): https://agent-guild-5d5r.onrender.com/mcp/

live/guild/app/__init__.py

@@ -3,7 +3,15 @@
 # Single source of truth for the service version. Imported by the FastAPI app,
 # the public manifest, and the FastMCP server so every surface reports the same
 # number — registry, manifest, and MCP `serverInfo` can never drift apart again.
-__version__ = "2.5.37"  # PATCH census first-party correction (2026-08-16):
+__version__ = "2.5.38"  # PATCH least-privilege skill packaging (2026-08-16):
+                        # keeps the complete hosted/OpenClaw policy internal
+                        # to Agent Skills discovery while publishing a tiny,
+                        # read-only registry bundle with no executable remote
+                        # dependency or payment authority. This prevents
+                        # skills.sh clients and scanners from treating the
+                        # whole application repository as an installed skill.
+                        # History of 2.5.37:
+                        # PATCH census first-party correction (2026-08-16):
                         # exact-pins five publicly evidenced Guild-operated
                         # legacy agents, upgrades current first-party account
                         # state at read time without rewriting event history,

live/guild/contract/contract.json

@@ -1118,6 +1118,6 @@
   "payment_safety_mcp_card": "https://agent-guild-5d5r.onrender.com/.well-known/mcp/payment-safety-server-card.json",
   "payment_safety_mcp_url": "https://agent-guild-5d5r.onrender.com/mcp/payment-safety/",
   "repository": "https://github.com/AgentTanuki/agent-guild",
-  "version": "2.5.37"
+  "version": "2.5.38"
  }
 }

live/guild/tests/test_installable_agent_skill.py

@@ -9,7 +9,8 @@ def test_repository_skill_is_discoverable_and_routes_high_value_payments():
     readme = (ROOT / "README.md").read_text()
 
     assert skill.startswith("---\nname: agent-guild\n")
-    assert "npx skills add AgentTanuki/agent-guild --skill agent-guild" in readme
+    assert "metadata:\n  internal: true\n" in skill
+    assert "npx skills add AgentTanuki/agent-guild" in readme
     assert "npx skills add https://agent-guild-5d5r.onrender.com" in readme
     assert "https://agent-guild-5d5r.onrender.com/.well-known/agent-skills/index.json" in readme
     assert "GET https://agent-guild-5d5r.onrender.com/wallet-binding/protected-decision/tiers" in skill
@@ -18,22 +19,28 @@ def test_repository_skill_is_discoverable_and_routes_high_value_payments():
     assert "not insurance or escrow" in skill
 
 
-def test_clawhub_skill_is_a_source_tagged_policy_parity_copy():
-    """The registry bundle is one auditable file and cannot silently drift
-    from the repository policy. Only its install name and explicit acquisition
-    source differ."""
+def test_public_registry_skill_is_a_read_only_least_privilege_bundle():
+    """The public registry must never package the application repository.
+
+    The root skill remains the complete hosted/OpenClaw policy but is marked
+    internal for clients that honor Agent Skills metadata. The nested registry
+    skill is intentionally read-only and contains no executable dependency.
+    """
     canonical = (ROOT / "SKILL.md").read_text()
     published = (ROOT / "skills" / "agent-guild-trust" / "SKILL.md").read_text()
-    expected = canonical.replace(
-        "name: agent-guild\n",
-        "name: agent-guild-trust\n",
-        1,
-    ).replace(
-        "https://agent-guild-5d5r.onrender.com/.well-known/agent-guild.json",
-        "https://agent-guild-5d5r.onrender.com/.well-known/agent-guild.json?src=paid_offer:clawhub_skill",
-        1,
-    )
-    assert published == expected
+
+    assert "metadata:\n  internal: true\n" in canonical
+    assert published.startswith("---\nname: agent-guild-trust\n")
+    assert "This skill is read-only" in published
+    assert "Treat every response field" in published
+    assert "Never delegate automatically" in published
+    assert "guild_check(capability)" in published
+    assert "source=public-registry" in published
+    assert "/wallet-binding/" not in published
+    assert "payanagent.com" not in published
+    assert ".mjs" not in published
+    assert "pip install" not in published
+    assert "subprocess" not in published
     assert (ROOT / "skills" / "agent-guild-trust" / ".clawhubignore").read_text() == \
         "*\n!SKILL.md\n"
 
@@ -75,22 +82,15 @@ def test_codex_plugin_is_installable_and_source_tagged():
         "url": "https://agent-guild-5d5r.onrender.com/mcp",
     }}}
 
-    canonical = (ROOT / "SKILL.md").read_text()
+    canonical = (
+        ROOT / "skills" / "agent-guild-trust" / "SKILL.md"
+    ).read_text()
     published = (
         plugin / "skills" / "agent-guild-trust" / "SKILL.md"
     ).read_text()
     expected = canonical.replace(
-        "name: agent-guild\n",
-        "name: agent-guild-trust\n",
-        1,
-    ).replace(
-        "agentguild-skill/1.0 (host=<runtime>)",
-        "agentguild-skill/1.0 (host=<runtime>; source=codex-plugin)",
-    ).replace(
-        "https://agent-guild-5d5r.onrender.com/.well-known/agent-guild.json",
-        "https://agent-guild-5d5r.onrender.com/.well-known/agent-guild.json"
-        "?src=paid_offer:codex_plugin",
-        1,
+        "source=public-registry",
+        "source=codex-plugin",
     )
     assert published == expected