Summary

The built-in skill-creator (skills/skill-creator/) directly writes SKILL.md via init_skill.py, bypassing the skill_workshop proposal workflow that the same system explicitly requires. This creates a self-contradiction within the repository.

The problem

1. Policy layer: the rule-maker breaks its own rule

skill_workshop injects a hard constraint into every Agent's system prompt:

"Do not create or change skill proposal files manually with write, edit, exec, shell commands, or direct filesystem operations."

This mandates that all skill creation and modification go through the controlled skill_workshop proposal pipeline. Yet init_skill.py in the built-in skill-creator does exactly what this rule forbids — it calls write_text() directly to create SKILL.md, with no proposal step whatsoever. When an Agent is routed to skill-creator to create a skill, it is executing a code path that the same system declares prohibited.

2. Tool layer: two parallel write paths with no awareness of each other

skill_workshop is designed as the single controlled entry point for writing skill files. Every write must pass through:

• proposal queue (provenance tracking)
• security scan
• hash binding (concurrent modification detection)
• approval policy
• rollback metadata

But init_skill.py is a second, completely unregulated path. Creating a skill through this path:

• generates no proposal record — no audit trail of who created what and when
• no hash binding — no detection of concurrent external modifications
• no rollback metadata — no undo or recovery
• approval policy is ignored entirely

The two paths operate independently with no mutual exclusion, cross-checking, or integration logic. Which path an Agent takes depends on which tool's triggering keywords match the prompt, not on a deliberate architectural decision.

Expected behavior

skill-creator should delegate file writes to skill_workshop (create/update/apply), so that all skill file modifications go through the unified proposal workflow. The init_skill.py direct-write path should be either removed or relegated to a documented fallback that only activates when skill_workshop is unavailable.

Current impact

Within the same repository, one system (skill_workshop, ~979 lines of service code) is dedicated to "safe, controlled writing", while another system (init_skill.py, one line of write_text()) bypasses all of it.