From 8147f5075b01dc408aafb50023505bf100bde8ef Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Sat, 28 Mar 2026 03:47:34 +0000
Subject: [PATCH] refactor: inline canonical skill source reads

---
 src/agents/skills-install.ts      |  3 +--
 src/agents/skills-status.ts       |  3 +--
 src/agents/skills.source.test.ts  | 16 ----------------
 src/agents/skills/config.ts       |  3 +--
 src/agents/skills/source.ts       |  6 ------
 src/security/audit-extra.async.ts |  3 +--
 6 files changed, 4 insertions(+), 30 deletions(-)
 delete mode 100644 src/agents/skills.source.test.ts
 delete mode 100644 src/agents/skills/source.ts

diff --git a/src/agents/skills-install.ts b/src/agents/skills-install.ts
index 586d2e99015..ed0528c1c3f 100644
--- a/src/agents/skills-install.ts
+++ b/src/agents/skills-install.ts
@@ -15,7 +15,6 @@ import {
   type SkillInstallSpec,
   type SkillsInstallPreferences,
 } from "./skills.js";
-import { resolveSkillSource } from "./skills/source.js";
 
 export type SkillInstallRequest = {
   workspaceDir: string;
@@ -441,7 +440,7 @@ export async function installSkill(params: SkillInstallRequest): Promise<SkillIn
 
   const spec = findInstallSpec(entry, params.installId);
   const warnings = await collectSkillInstallScanWarnings(entry);
-  const skillSource = resolveSkillSource(entry.skill);
+  const skillSource = entry.skill.sourceInfo?.source?.trim() || "unknown";
 
   // Warn when install is triggered from a non-bundled source.
   // Workspace/project/personal agent skills can contain attacker-controlled metadata.
diff --git a/src/agents/skills-status.ts b/src/agents/skills-status.ts
index 70d2919a04b..37ba8e5613a 100644
--- a/src/agents/skills-status.ts
+++ b/src/agents/skills-status.ts
@@ -17,7 +17,6 @@ import {
   type SkillsInstallPreferences,
 } from "./skills.js";
 import { resolveBundledSkillsContext } from "./skills/bundled-context.js";
-import { resolveSkillSource } from "./skills/source.js";
 
 export type SkillStatusConfigCheck = RequirementConfigCheck;
 
@@ -187,7 +186,7 @@ function buildSkillStatus(
       (skillConfig?.apiKey && entry.metadata?.primaryEnv === envName),
     );
   const isConfigSatisfied = (pathStr: string) => isConfigPathTruthy(config, pathStr);
-  const skillSource = resolveSkillSource(entry.skill);
+  const skillSource = entry.skill.sourceInfo?.source?.trim() || "unknown";
   const bundled =
     skillSource === "openclaw-bundled" ||
     (skillSource === "unknown" && bundledNames?.has(entry.skill.name) === true);
diff --git a/src/agents/skills.source.test.ts b/src/agents/skills.source.test.ts
deleted file mode 100644
index 058afb76e0b..00000000000
--- a/src/agents/skills.source.test.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { resolveSkillSource } from "./skills/source.js";
-
-describe("resolveSkillSource", () => {
-  it("prefers sourceInfo.source when present", () => {
-    expect(
-      resolveSkillSource({
-        sourceInfo: { source: "openclaw-bundled" },
-      } as never),
-    ).toBe("openclaw-bundled");
-  });
-
-  it("returns unknown when neither source shape is present", () => {
-    expect(resolveSkillSource({} as never)).toBe("unknown");
-  });
-});
diff --git a/src/agents/skills/config.ts b/src/agents/skills/config.ts
index fd2e0644bfc..0392271264f 100644
--- a/src/agents/skills/config.ts
+++ b/src/agents/skills/config.ts
@@ -8,7 +8,6 @@ import {
 } from "../../shared/config-eval.js";
 import { normalizeStringEntries } from "../../shared/string-normalization.js";
 import { resolveSkillKey } from "./frontmatter.js";
-import { resolveSkillSource } from "./source.js";
 import type { SkillEligibilityContext, SkillEntry } from "./types.js";
 
 const DEFAULT_CONFIG_VALUES: Record<string, boolean> = {
@@ -51,7 +50,7 @@ function normalizeAllowlist(input: unknown): string[] | undefined {
 const BUNDLED_SOURCES = new Set(["openclaw-bundled"]);
 
 function isBundledSkill(entry: SkillEntry): boolean {
-  return BUNDLED_SOURCES.has(resolveSkillSource(entry.skill));
+  return BUNDLED_SOURCES.has(entry.skill.sourceInfo?.source ?? "");
 }
 
 export function resolveBundledAllowlist(config?: OpenClawConfig): string[] | undefined {
diff --git a/src/agents/skills/source.ts b/src/agents/skills/source.ts
deleted file mode 100644
index e2e5df50c3e..00000000000
--- a/src/agents/skills/source.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-import type { Skill } from "@mariozechner/pi-coding-agent";
-
-export function resolveSkillSource(skill: Skill): string {
-  const source = typeof skill.sourceInfo?.source === "string" ? skill.sourceInfo.source.trim() : "";
-  return source || "unknown";
-}
diff --git a/src/security/audit-extra.async.ts b/src/security/audit-extra.async.ts
index 1b81411d4e1..026c5ad66a6 100644
--- a/src/security/audit-extra.async.ts
+++ b/src/security/audit-extra.async.ts
@@ -11,7 +11,6 @@ import { SANDBOX_BROWSER_SECURITY_HASH_EPOCH } from "../agents/sandbox/constants
 import { execDockerRaw, type ExecDockerRawResult } from "../agents/sandbox/docker.js";
 import { resolveSandboxToolPolicyForAgent } from "../agents/sandbox/tool-policy.js";
 import type { SandboxToolPolicy } from "../agents/sandbox/types.js";
-import { resolveSkillSource } from "../agents/skills/source.js";
 import { isToolAllowedByPolicies } from "../agents/tool-policy-match.js";
 import { resolveToolProfilePolicy } from "../agents/tool-policy.js";
 import { listAgentWorkspaceDirs } from "../agents/workspace-dirs.js";
@@ -1262,7 +1261,7 @@ export async function collectInstalledSkillsCodeSafetyFindings(params: {
   for (const workspaceDir of workspaceDirs) {
     const entries = loadWorkspaceSkillEntries(workspaceDir, { config: params.cfg });
     for (const entry of entries) {
-      if (resolveSkillSource(entry.skill) === "openclaw-bundled") {
+      if (entry.skill.sourceInfo?.source === "openclaw-bundled") {
         continue;
       }