fix(mcp): load skills on Windows

apps/mcp/src/skills.ts

@@ -14,8 +14,11 @@ export function listSkills(): string[] {
 }
 
 export function loadSkill(name: string): string {
-  const resolved = resolve(SKILLS_DIR, `${name}.txt`);
-  if (!resolved.startsWith(resolve(SKILLS_DIR) + "/")) {
+  const root = resolve(SKILLS_DIR);
+  const resolved = resolve(root, `${name}.txt`);
+  // Compare directories rather than a "/" prefix so the check also holds
+  // for the backslash paths that resolve() returns on Windows.
+  if (dirname(resolved) !== root) {
     throw new Error(`Invalid skill name: ${name}`);
   }
   return readFileSync(resolved, "utf-8");

apps/mcp/tests/skills.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from "vitest";
-import { listSkills } from "../src/skills";
+import { listSkills, loadSkill } from "../src/skills";
 
 describe("listSkills", () => {
   it("returns an array containing the bundled skills", () => {
@@ -8,3 +8,16 @@ describe("listSkills", () => {
     expect(skills).toContain("master-agent-playbook");
   });
 });
+
+describe("loadSkill", () => {
+  it("loads a bundled skill by name", () => {
+    expect(loadSkill("master-agent-playbook").length).toBeGreaterThan(0);
+  });
+
+  it.each(["../package", "nested/skill", "/etc/passwd"])(
+    "rejects names outside the skills directory: %s",
+    (name) => {
+      expect(() => loadSkill(name)).toThrow("Invalid skill name");
+    }
+  );
+});