Problem

Skills synced from skill-server can include executable resource files, such as Bash or Python helpers. Agents can discover and read these resources, but attempts to execute them are blocked, including in Personal mode.

This affects both main-agent execution and routed/sub-agent skill execution.

Symptoms

• Shell commands referencing ~/.netclaw/skills/.server-feeds/... or ~/.netclaw/skills/.system/... are denied with shell_references_protected_path.
• Direct execution may also fail because synced resources are materialized as plain text without executable mode metadata.
• Slash-routed skill sub-agents cannot request shell approval because routed slash execution does not attach the parent approval bridge.
• Newer skill-server archive artifacts may not sync correctly because Netclaw's server-feed sync still downloads entry.Url as text.

Root causes

• Netclaw includes .system and .server-feeds skill directories in shell protected paths.
• Personal mode does not bypass protected path or hard-deny checks.
• Skill sync materializes resource files with File.WriteAllTextAsync, preserving no executable metadata.
• skill-server ZIP archives clear external attributes, so archive extraction would not preserve executable bits either.
• Routed slash-command sub-agent execution sets SupportsInteractiveApproval = false and does not provide an ApprovalBridge.
• Netclaw's server-feed sync is not archive-aware.

Expected behavior

Agents should be able to execute executable skill resources in Personal mode after normal shell-equivalent authorization and approval, without running directly from managed skill-feed directories.

Executable resources should not be restricted to scripts/ only. AgentSkills.io uses scripts/ as the conventional location, but permits additional directories under a skill root. Netclaw should allow executable resources that resolve inside a registered skill directory, while still linting/preference-guiding authors toward scripts/ in skill-server.

Proposed fix

• Add first-class skill resource execution support that validates the resource belongs to a registered skill root, rejects traversal and symlinks, stages the resource into session scratch, and executes the staged copy.
• Run the staged execution through shell-equivalent policy and approval. Do not loosen direct shell access to .system or .server-feeds.
• Wire parent approval bridge into slash-routed skill sub-agents.
• Add archive-aware skill-server sync or fail loudly with a clear unsupported-artifact message for archive entries.
• Update system skill guidance and tests.

Verification

• Main Personal session can execute an executable skill resource after approval.
• Direct shell execution from .server-feeds remains denied.
• Slash-routed sub-agent can request parent approval for shell-backed resource execution.
• Public and Team audiences cannot execute skill resources unless policy explicitly allows shell-equivalent execution.
• Resourceful skill-server archive skills sync or fail loudly with a clear unsupported-artifact message.

Related: netclaw-dev/skill-server#102