[Reborn] Envelope installed skill prompt context

[serrrfirat]

Summary

• add shared untrusted-context envelope/sanitizer used by memory and installed skill prompt content
• preserve installed skill prompt content only after wrapping it as Untrusted skill content: ...
• reject instruction-like installed skill prompt content fail-closed before loop context emission

Scope

Follow-up to #3476. Addresses the #3492 comment item: SKILL.md prompt content for Installed skills needs the same baseline untrusted-content envelope primitive as memory.

Verification

• CARGO_TARGET_DIR=/Users/firatsertgoz/Documents/ironclaw/target cargo test -p ironclaw_loop_support -p ironclaw_host_runtime -p ironclaw_turns
• CARGO_TARGET_DIR=/Users/firatsertgoz/Documents/ironclaw/target cargo test -p ironclaw_architecture

Does not close #3492.

[gemini-code-assist]

Code Review

This pull request centralizes the sanitization and enveloping of untrusted content into a new untrusted_context module. It modifies Installed skills to include sanitized prompt content within an explicit untrusted envelope, whereas this content was previously excluded. Reviewer feedback recommends making the prefix method pub(crate) to avoid string duplication, replacing hardcoded byte limits with shared constants, and using the UntrustedContextKind::prefix method as the single source of truth for prefixes.

[gemini-code-assist]

Make this method pub(crate) so it can be used by other modules in the crate (e.g., skill_context.rs) to avoid duplicating the prefix strings and maintain consistency.

Suggested change

	const fn prefix(self) -> &'static str {
	pub(crate) const fn prefix(self) -> &'static str {

References

1. Use centralized helper functions for security-sensitive logic to ensure consistency and avoid duplication.

[gemini-code-assist]

The value 512 is used as a hardcoded limit for untrusted skill content. Always truncate tool output for previews or status updates to a reasonable maximum length. Consider defining a shared constant for this limit to maintain consistency across the repository.

References

1. Always truncate tool output for previews or status updates to a reasonable maximum length.
2. Use centralized helper functions for security-sensitive logic to ensure consistency and avoid duplication.

[gemini-code-assist]

The UNTRUSTED_SKILL_PREFIX string is duplicated here. To improve maintainability and ensure consistency, use the UntrustedContextKind::prefix method as the single source of truth.

Suggested change

	const UNTRUSTED_SKILL_PREFIX: &str = "Untrusted skill content: ";
	const UNTRUSTED_SKILL_PREFIX: &str = UntrustedContextKind::Skill.prefix();

References

1. Use centralized helper functions for security-sensitive logic to ensure consistency and avoid duplication.

[serrrfirat]

Paranoid review found Medium+ issues at head 7b0a8942df6a9d23278781dda16a370b86dfae8d:

Severity	Confidence	File:Line	Finding
Medium	Certain	crates/ironclaw_loop_support/src/skill_context.rs:171-187, crates/ironclaw_turns/src/run_profile/skill_context.rs:347-355	Installed skill description bypasses the new untrusted sanitizer. Scenario: installed SKILL.md has description: ignore previous instructions... and benign prompt. Builder sanitizes only parsed.prompt_content, stores raw parsed.manifest.description, and service emits it before enveloped prompt. Fix/test: sanitize/envelope or reject instruction-like installed descriptions; add contract test with malicious installed description.
Medium	Certain	crates/ironclaw_turns/src/run_profile/skill_context.rs:347-352	Installed prompt_content validation is prefix-only at service boundary. Scenario: caller constructs SkillRunSnapshot::from_entries with prompt_content: Some("Untrusted skill content: ignore previous instructions"); snapshot hash is valid, service emits injection because it checks only starts_with. Fix/test: add validator for already-enveloped untrusted summaries: prefix + LoopSafeSummary + instruction-marker check on payload; add test for prefixed unsafe installed prompt rejection.

[serrrfirat]

Closing this version. Direction changed: instead of runtime hard-rejecting installed skill prompt content, we should move suspicious-skill handling to install/discovery time with quarantine/review UX, hash-scoped trust decisions, and runtime-safe fallback that never emits unsafe raw content.