Auto-activating frontmatter is honoured on workspace-synced skills

[sahrizvi]

Deferred from the v0.10.0 release review. Known and accepted for the pilot — filed for tracking, not as a surprise.

alwaysApply / applyPaths frontmatter is honoured on workspace-synced skills exactly as on local ones. A skill carrying alwaysApply: true is loaded into the system prompt with no Skill-tool call and no permission prompt.

Since v0.10.0, skill bundles are remote content pulled from the bound workspace. So anyone with upload rights to a workspace can place standing instructions into the system prompt of every member bound to it.

This is documented as a deliberate decision at packages/opencode/src/altimate/workspace/skill-sync.ts:11-30, scoped to who can currently upload.

Revisit when upload rights widen beyond the pilot cohort — the risk scales directly with that group.

[sahrizvi]

Reopening — closed in error. This was listed in the v0.10.0 PR body as a deferred finding and GitHub read it as a closing reference. It is not fixed: auto-activating frontmatter still applies to workspace-synced skills, as accepted for the pilot and documented at skill-sync.ts:11-30. Still to revisit before upload rights widen.