[dotnet-port-fixes] Harden file skill discovery

[Michelle Clayton (michelle-clayton-work)]

Summary

Port the .NET file-skill discovery hardening from microsoft/agent-framework#7540 into the Go agent/skills/fsskills loader. The Go change now skips symlinked SKILL.md files, resources, and scripts during discovery while still allowing a caller-configured root path that is itself a symlink.

Ported .NET PRs

• .NET: Harden file skill discovery agent-framework#7540 - Harden file skill discovery (94bbfb2ac8382450219afd978bbe17b7eb44efbf)

Breaking Changes

No. Exported Go APIs are unchanged; the loader only rejects unsafe file-skill paths that previously could be followed through symlinks.

Tests and Examples

• Added parity tests for symlinked SKILL.md, resource, and script paths, plus configured-root symlink support
• Ran go test ./agent/skills/fsskills

Notes

• This PR keeps the scope to the file-skill symlink hardening that maps cleanly to the existing Go API surface.
• The existing Go discovery logic already continues past unreadable directories without aborting sibling skill discovery, so no additional API-safe change was needed there.
• Upstream commit: microsoft/agent-framework@94bbfb2

Generated by .NET to Go Fixes and Test Porting Agent · gpt54 · 215.2 AIC · ⌖ 13.2 AIC · ⊞ 24.2K · ◷

Closes #822

[Copilot]

Pull request overview

This PR ports the .NET “file-skill discovery hardening” behavior into the Go agent/skills/fsskills loader by adding symlink/inspection checks so discovery skips symlinked SKILL.md files, resources, and scripts while still allowing a caller-provided root that is itself a symlink.

Changes:

• Hardened skill directory discovery to avoid treating symlinked SKILL.md as a valid skill marker.
• Hardened resource/script discovery to skip symlinked (or uninspectable) entries during scan.
• Added tests covering symlinked SKILL.md, resources, scripts, and symlinked configured-root behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
agent/skills/fsskills/source.go	Adds symlink/inspection checks during skill, resource, and script discovery.
agent/skills/fsskills/source_test.go	Adds tests for symlinked SKILL.md, symlinked configured root, and symlinked resources.
agent/skills/fsskills/source_script_test.go	Adds a test ensuring symlinked scripts are skipped.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Michelle Clayton (michelle-clayton-work)]

Copilot resolve the merge conflicts in this pull request

[Copilot]

Copilot resolve the merge conflicts in this pull request

Resolved by merging main and keeping the more complete hardening implementation from this branch. Also fixed the earlier return-vs-continue bug flagged in review: an unsafe/symlinked SKILL.md now only stops the marker-check loop, so nested skill directories below it are still discovered (added regression test TestFileSource_SymlinkedSkillFile_DoesNotAbortNestedDiscovery).

[github-actions]

Parity Review: ✅ Approved

This PR ports symlink-hardening behavior from upstream .NET PR microsoft/agent-framework#7540 into the Go agent/skills/fsskills loader.

Scope: agent/skills/fsskills/source.go — internal discovery logic only. No exported Go APIs were added, removed, or changed.

Parity check:

• The Go change now skips symlinked SKILL.md files, resource paths, and script paths during discovery, directly matching the .NET hardening behavior from commit 94bbfb2.
• The caller-configured root being a symlink continues to work in both Go and .NET, preserving the existing opt-in flexibility.
• No equivalent Python skill-file-discovery surface was found in python/packages/core/agent_framework/; this behavior appears .NET/Go-specific.

Conclusion: The change preserves cross-repo semantic parity with the .NET implementation. No public-api-change label is warranted. The parity-approved label correctly reflects the state of this PR.

Generated by Go API Consistency Review Agent for #833 · sonnet46 · 16.5 AIC · ⌖ 4.69 AIC · ⊞ 5.7K · ◷