fix: harden skill template contracts and scaffolding

Align scaffold slug replacement, Action manifest strict boundaries, metadata prune API, field permission validation, and task_logs readonly semantics with documented template contracts.

Co-authored-by: Cursor <cursoragent@cursor.com>

tools/scaffold_skill.py

@@ -11,7 +11,8 @@ from pathlib import Path
 EXCLUDE_DIR_NAMES = {".git", ".pytest_cache", "__pycache__"}
 EXCLUDE_FILE_NAMES = {".env", ".env.local"}
 KEBAB_SLUG = re.compile(r"^[a-z0-9]+(-[a-z0-9]+)*$")
-TEMPLATE_PLACEHOLDER_SLUG = "your-skill-slug"
+TEMPLATE_PLACEHOLDER_SLUG_KEBAB = "your-skill-slug"
+TEMPLATE_PLACEHOLDER_SLUG_UNDERSCORE = "your_skill_slug"
 TEXT_FILE_SUFFIXES = {
     ".md",
     ".py",
@@ -46,8 +47,13 @@ def _should_replace_placeholders(path: Path) -> bool:
     return False
 
 
+def _slug_to_underscore(slug: str) -> str:
+    return slug.replace("-", "_")
+
+
 def _replace_template_placeholders(target: Path, slug: str) -> None:
     """将模板占位 slug 替换为新技能 slug（不修改 action 业务命令结构）。"""
+    underscore_slug = _slug_to_underscore(slug)
     for path in target.rglob("*"):
         if not path.is_file():
             continue
@@ -59,9 +65,14 @@ def _replace_template_placeholders(target: Path, slug: str) -> None:
             text = path.read_text(encoding="utf-8")
         except UnicodeDecodeError:
             continue
-        if TEMPLATE_PLACEHOLDER_SLUG not in text:
+        if (
+            TEMPLATE_PLACEHOLDER_SLUG_KEBAB not in text
+            and TEMPLATE_PLACEHOLDER_SLUG_UNDERSCORE not in text
+        ):
             continue
-        path.write_text(text.replace(TEMPLATE_PLACEHOLDER_SLUG, slug), encoding="utf-8")
+        updated = text.replace(TEMPLATE_PLACEHOLDER_SLUG_KEBAB, slug)
+        updated = updated.replace(TEMPLATE_PLACEHOLDER_SLUG_UNDERSCORE, underscore_slug)
+        path.write_text(updated, encoding="utf-8")
 
 
 def _print_next_steps(target: Path) -> None: