fix: harden skill template contracts and scaffolding

Align scaffold slug replacement, Action manifest strict boundaries, metadata prune API, field permission validation, and task_logs readonly semantics with documented template contracts.

Co-authored-by: Cursor <cursoragent@cursor.com>

assets/README.md

@@ -1,8 +1,10 @@
 # assets
 
-- `actions.json`：Skill Action manifest 最小示例（可选；不需要宿主入口时可删除）。
+- `actions.json`：Skill Action manifest 最小示例（**可选**；不需要宿主入口时可删除）。
 - `examples/`：CLI 成功输出形状示例（虚构路径与数据）。
-- `schemas/`：轻量 JSON Schema（`skill-actions.schema.json`、`task-log-record.schema.json` 等）。
+- `schemas/`：轻量 JSON Schema（`skill-actions.schema.json` 为**新技能严格规范**；`task-log-record.schema.json` 等）。
+
+`skill-actions.schema.json` 使用 `additionalProperties: false` 表达模板推荐契约；宿主运行时可能更宽松以兼容历史 manifest。`row`/`batch` placements 与 `bind`/`concurrency`/`locks` 为预留能力，当前模板示例不得使用。
 
 - 用户市场说明见根目录 [`README.md`](../README.md)
 - Agent 调用/编排参考见 [`references/`](../references/)（含 [`ACTIONS.md`](../references/ACTIONS.md)）

assets/schemas/skill-actions.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://openclaw.local/skill-template/skill-actions.schema.json",
   "title": "SkillActionManifest",
-  "description": "匠厂宿主 Skill Action manifest 通用契约（schemaVersion 1）",
+  "description": "匠厂 skill-template 对新技能的严格 Action manifest 规范（schemaVersion 1）。additionalProperties=false 表示模板推荐契约；宿主运行时可能为兼容历史 manifest 接受部分缺省字段，但新技能不应依赖缺省行为。",
   "type": "object",
   "required": ["schemaVersion", "skill", "actions"],
   "additionalProperties": false,
@@ -25,7 +25,8 @@
   "$defs": {
     "placement": {
       "type": "string",
-      "enum": ["toolbar", "row", "batch", "cron", "agent", "skill-detail"]
+      "enum": ["toolbar", "row", "batch", "cron", "agent", "skill-detail"],
+      "description": "模板 Phase 1 稳定支持 toolbar/cron/agent/skill-detail；row/batch 为预留入口，新技能示例不得使用"
     },
     "scalarArg": {
       "type": ["string", "number", "boolean"]
@@ -37,7 +38,8 @@
       "properties": {
         "type": {
           "type": "string",
-          "enum": ["string", "number", "boolean", "object"]
+          "enum": ["string", "number", "boolean", "object"],
+          "description": "模板 Phase 1 仅推荐 string/number/boolean；根 inputSchema.type=object 的 properties 使用基础标量类型"
         },
         "title": { "type": "string" },
         "description": { "type": "string" },
@@ -77,7 +79,8 @@
         },
         "args": {
           "type": "array",
-          "items": { "$ref": "#/$defs/scalarArg" }
+          "items": { "$ref": "#/$defs/scalarArg" },
+          "description": "仅允许 string/number/boolean 标量数组"
         }
       }
     },
@@ -118,7 +121,8 @@
         "entrypoint": { "$ref": "#/$defs/entrypoint" },
         "inputSchema": { "$ref": "#/$defs/inputSchema" },
         "confirmation": { "$ref": "#/$defs/confirmation" }
-      }
+      },
+      "description": "模板 Phase 1 不包含 bind/concurrency/locks 等预留能力字段；宿主类型可能定义这些字段，但新技能不得依赖"
     }
   }
 }