refactor: inline canonical skill source reads

src/agents/skills-install.ts

@@ -15,7 +15,6 @@ import {
   type SkillInstallSpec,
   type SkillsInstallPreferences,
 } from "./skills.js";
-import { resolveSkillSource } from "./skills/source.js";
 
 export type SkillInstallRequest = {
   workspaceDir: string;
@@ -441,7 +440,7 @@ export async function installSkill(params: SkillInstallRequest): Promise<SkillIn
 
   const spec = findInstallSpec(entry, params.installId);
   const warnings = await collectSkillInstallScanWarnings(entry);
-  const skillSource = resolveSkillSource(entry.skill);
+  const skillSource = entry.skill.sourceInfo?.source?.trim() || "unknown";
 
   // Warn when install is triggered from a non-bundled source.
   // Workspace/project/personal agent skills can contain attacker-controlled metadata.

src/agents/skills-status.ts

@@ -17,7 +17,6 @@ import {
   type SkillsInstallPreferences,
 } from "./skills.js";
 import { resolveBundledSkillsContext } from "./skills/bundled-context.js";
-import { resolveSkillSource } from "./skills/source.js";
 
 export type SkillStatusConfigCheck = RequirementConfigCheck;
 
@@ -187,7 +186,7 @@ function buildSkillStatus(
       (skillConfig?.apiKey && entry.metadata?.primaryEnv === envName),
     );
   const isConfigSatisfied = (pathStr: string) => isConfigPathTruthy(config, pathStr);
-  const skillSource = resolveSkillSource(entry.skill);
+  const skillSource = entry.skill.sourceInfo?.source?.trim() || "unknown";
   const bundled =
     skillSource === "openclaw-bundled" ||
     (skillSource === "unknown" && bundledNames?.has(entry.skill.name) === true);

src/agents/skills.source.test.ts

@@ -1,16 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { resolveSkillSource } from "./skills/source.js";
-
-describe("resolveSkillSource", () => {
-  it("prefers sourceInfo.source when present", () => {
-    expect(
-      resolveSkillSource({
-        sourceInfo: { source: "openclaw-bundled" },
-      } as never),
-    ).toBe("openclaw-bundled");
-  });
-
-  it("returns unknown when neither source shape is present", () => {
-    expect(resolveSkillSource({} as never)).toBe("unknown");
-  });
-});

src/agents/skills/config.ts

@@ -8,7 +8,6 @@ import {
 } from "../../shared/config-eval.js";
 import { normalizeStringEntries } from "../../shared/string-normalization.js";
 import { resolveSkillKey } from "./frontmatter.js";
-import { resolveSkillSource } from "./source.js";
 import type { SkillEligibilityContext, SkillEntry } from "./types.js";
 
 const DEFAULT_CONFIG_VALUES: Record<string, boolean> = {
@@ -51,7 +50,7 @@ function normalizeAllowlist(input: unknown): string[] | undefined {
 const BUNDLED_SOURCES = new Set(["openclaw-bundled"]);
 
 function isBundledSkill(entry: SkillEntry): boolean {
-  return BUNDLED_SOURCES.has(resolveSkillSource(entry.skill));
+  return BUNDLED_SOURCES.has(entry.skill.sourceInfo?.source ?? "");
 }
 
 export function resolveBundledAllowlist(config?: OpenClawConfig): string[] | undefined {

src/agents/skills/source.ts

@@ -1,6 +0,0 @@
-import type { Skill } from "@mariozechner/pi-coding-agent";
-
-export function resolveSkillSource(skill: Skill): string {
-  const source = typeof skill.sourceInfo?.source === "string" ? skill.sourceInfo.source.trim() : "";
-  return source || "unknown";
-}

src/security/audit-extra.async.ts

@@ -11,7 +11,6 @@ import { SANDBOX_BROWSER_SECURITY_HASH_EPOCH } from "../agents/sandbox/constants
 import { execDockerRaw, type ExecDockerRawResult } from "../agents/sandbox/docker.js";
 import { resolveSandboxToolPolicyForAgent } from "../agents/sandbox/tool-policy.js";
 import type { SandboxToolPolicy } from "../agents/sandbox/types.js";
-import { resolveSkillSource } from "../agents/skills/source.js";
 import { isToolAllowedByPolicies } from "../agents/tool-policy-match.js";
 import { resolveToolProfilePolicy } from "../agents/tool-policy.js";
 import { listAgentWorkspaceDirs } from "../agents/workspace-dirs.js";
@@ -1262,7 +1261,7 @@ export async function collectInstalledSkillsCodeSafetyFindings(params: {
   for (const workspaceDir of workspaceDirs) {
     const entries = loadWorkspaceSkillEntries(workspaceDir, { config: params.cfg });
     for (const entry of entries) {
-      if (resolveSkillSource(entry.skill) === "openclaw-bundled") {
+      if (entry.skill.sourceInfo?.source === "openclaw-bundled") {
         continue;
       }