fix: isolate configured skill loading

Author: HandleCoding

.env.example

@@ -49,7 +49,7 @@ WEB_NO_PROXY=
 # Optional tool integrations. Enable only when configured intentionally.
 BROWSER_ENABLED=false
 MCP_ENABLED=false
-MCP_CONFIG_PATH=mcp-servers.json
+MCP_CONFIG_PATH=~/.husky/config/mcp-servers.json
 
 # SkillHub community skill search
 SKILLHUB_API_KEY=

infra/src/main/java/io/github/huskyagent/infra/skill/SkillLoader.java

@@ -60,19 +60,13 @@ public SkillLoader(SkillManager skillManager, HuskyDataPaths dataPaths) {
     public void load() {
         skillDirMap.clear();
         List<Skill> skills = new ArrayList<>();
-        Path userHome = Path.of(System.getProperty("user.home"));
-        Path projectDir = Path.of(System.getProperty("user.dir"));
-
-        scanSkillDir(resolveBuiltinSkillDir(),                  "builtin",        skills);
-        scanSkillDir(userHome.resolve(".claude").resolve("skills"),   "global-claude",  skills);
-        scanSkillDir(userHome.resolve(".husky").resolve("skills"),    "global-husky",   skills);
-        scanSkillDir(projectDir.resolve(".claude").resolve("skills"), "project-claude", skills);
+        scanSkillDir(resolveBuiltinSkillDir(), "builtin", skills);
         for (Path managedRoot : scanSkillRoots()) {
             scanSkillDir(managedRoot, "managed-husky", skills);
         }
 
         skillManager.setSkills(skills);
-        log.info("Loaded {} skills (builtin + global + project)", skills.size());
+        log.info("Loaded {} skills (builtin + configured)", skills.size());
     }
 
     private void scanSkillDir(Path dir, String source, List<Skill> skills) {
@@ -285,15 +279,8 @@ void setBuiltinDirForTesting(String builtinDir) {
     }
 
     public Set<Path> getWatchedRoots() {
-        Path userHome = Path.of(System.getProperty("user.home"));
-        Path projectDir = Path.of(System.getProperty("user.dir"));
         return Stream.concat(
-                        Stream.of(
-                                resolveSkillDir(builtinDir),
-                                userHome.resolve(".claude").resolve("skills"),
-                                userHome.resolve(".husky").resolve("skills"),
-                                projectDir.resolve(".claude").resolve("skills")
-                        ),
+                        Stream.of(resolveSkillDir(builtinDir)),
                         scanSkillRoots().stream()
                 )
                 .map(Path::toAbsolutePath)

infra/src/test/java/io/github/huskyagent/infra/skill/SkillLoaderTest.java

@@ -124,6 +124,33 @@ void patchAllowsConfiguredManagedDirBeyondSkillDir() throws IOException {
         assertEquals("patched", skillManager.getSkill("global").content());
     }
 
+    @Test
+    void loadUsesConfiguredSkillRootsOnly() throws IOException {
+        Path fixedGlobal = tempDir.resolve("home/.husky/skills");
+        Path fixedClaude = tempDir.resolve("home/.claude/skills");
+        Path fixedProject = tempDir.resolve("project/.claude/skills");
+        String oldUserHome = System.getProperty("user.home");
+        String oldUserDir = System.getProperty("user.dir");
+        try {
+            System.setProperty("user.home", tempDir.resolve("home").toString());
+            System.setProperty("user.dir", tempDir.resolve("project").toString());
+            createSkill(fixedGlobal, "global_husky", "global");
+            createSkill(fixedClaude, "global_claude", "global");
+            createSkill(fixedProject, "project_claude", "project");
+            createManagedSkill("configured", List.of());
+
+            loader.load();
+
+            assertNotNull(skillManager.getSkill("configured"));
+            assertNull(skillManager.getSkill("global_husky"));
+            assertNull(skillManager.getSkill("global_claude"));
+            assertNull(skillManager.getSkill("project_claude"));
+        } finally {
+            System.setProperty("user.home", oldUserHome);
+            System.setProperty("user.dir", oldUserDir);
+        }
+    }
+
     @Test
     void managedSkillRootsDefaultToSkillDir() {
         assertEquals(List.of(managedSkills.toAbsolutePath().normalize()), loader.managedSkillRoots());

service/src/main/resources/application.yml

@@ -395,10 +395,9 @@ auth:
 # Skill configuration
 skill:
   builtin-dir: builtin-skills
-  # write target for install/create — also scanned as highest-priority source
-  # auto-scanned (lower priority): ~/.claude/skills, ~/.husky/skills, .claude/skills
+  # write target for install/create; also scanned for installed or user-authored skills
   dir: ${husky.data.dir}/skills
-  # skill_manage patch/delete is restricted to skills loaded from these configured writable roots.
+  # skill_manage patch/delete is restricted to skills loaded from these configured writable roots; these roots are also scanned.
   managed-dirs: ${SKILL_MANAGED_DIRS:${skill.dir}}
   disabled: []