Summary

The agents.list[].skills filter configured in openclaw.json is not applied consistently across all code paths, and cached skill snapshots are never refreshed when the filter changes.

Steps to Reproduce

1. Configure a per-agent skills filter:

   {
     "agents": {
       "list": [{
         "id": "my-agent",
         "skills": ["weather", "news-rss", "flight-search"]
       }]
     }
   }

2. Run openclaw agent --agent my-agent --message "test" --json
3. Check systemPromptReport.skills.entries in the response JSON

Expected Behavior

Only the skills listed in the agent's skills array should appear in systemPromptReport.skills.entries.

Actual Behavior

Two issues found:

1. Gateway system-prompt path missing skillFilter

resolveCommandsSystemPromptBundle() in src/auto-reply/reply/commands-system-prompt.ts calls buildWorkspaceSkillSnapshot() without passing the agent's skillFilter. The cron path and get-reply path correctly resolve and pass it, but the commands-system-prompt path was missed.

2. Agent CLI never refreshes stale skill snapshots

src/commands/agent.ts only rebuilds the skill snapshot when isNewSession || !sessionEntry?.skillsSnapshot. It does not compare:

• The cached skillFilter against the current agent config
• The cached snapshotVersion against the current version

This means if a session was created before the skills filter was added to the agent config, the stale snapshot (with all skills, no filter) is reused forever. Deleting the session forces a correct rebuild with 7 skills, confirming the filter code itself works.

Root Cause

• commands-system-prompt.ts: Missing resolveAgentSkillsFilter() call
• agent.ts: Missing matchesSkillFilter() and version comparison in needsSkillsSnapshot condition

Fix

1. Import resolveAgentSkillsFilter in commands-system-prompt.ts and pass it to buildWorkspaceSkillSnapshot()
2. Add matchesSkillFilter() and snapshotVersion checks to the refresh condition in agent.ts, matching the gateway (session-updates.ts) and cron (skills-snapshot.ts) paths

Impact

• Agents with specific skill needs (e.g., a group chat agent that should use news-rss and flight-tracker) get all ~100+ skills instead of their configured subset
• Changing an agent's skills config has no effect on existing sessions until the session is manually deleted
• Workaround: delete the session file or add explicit exec commands in workspace docs (AGENTS.md)

Environment

• OpenClaw 2026.3.8 (3caab92)
• macOS Darwin 25.3.0