command auth has been relaxed by default

src/agent/loop_.rs

@@ -3820,7 +3820,10 @@ mod tests {
                 tool_call_id: None,
             },
         ];
-        let approval_cfg = crate::config::AutonomyConfig::default();
+        let approval_cfg = crate::config::AutonomyConfig {
+            level: crate::security::AutonomyLevel::Supervised,
+            ..crate::config::AutonomyConfig::default()
+        };
         let approval_mgr = ApprovalManager::from_config(&approval_cfg);
 
         assert!(!should_execute_tools_in_parallel(

src/config/mod.rs

@@ -14,9 +14,9 @@ pub use schema::{
     OtpConfig, OtpMethod, PeripheralBoardConfig, PeripheralsConfig, ProxyConfig, ProxyScope,
     QdrantConfig, QueryClassificationConfig, ReliabilityConfig, ResourceLimitsConfig,
     RuntimeConfig, SandboxBackend, SandboxConfig, SchedulerConfig, SecretsConfig, SecurityConfig,
-    SkillsConfig, SkillsPromptInjectionMode, SlackConfig, StorageConfig, StorageProviderConfig,
+    SkillSecurityAuditConfig, SkillsConfig, SkillsPromptInjectionMode, SlackConfig, StorageConfig,
-    StorageProviderSection, StreamMode, TelegramConfig, TranscriptionConfig, TunnelConfig,
+    StorageProviderConfig, StorageProviderSection, StreamMode, TelegramConfig, TranscriptionConfig,
-    WebFetchConfig, WebSearchConfig, WebhookConfig,
+    TunnelConfig, WebFetchConfig, WebSearchConfig, WebhookConfig,
 };
 
 pub fn name_and_presence<T: traits::ChannelConfig>(channel: Option<&T>) -> (&'static str, bool) {

src/config/schema.rs

@@ -456,6 +456,58 @@ fn parse_skills_prompt_injection_mode(raw: &str) -> Option<SkillsPromptInjection
     }
 }
 
+/// Skill security audit configuration (`[skills.security_audit]` section).
+#[allow(clippy::struct_excessive_bools)]
+#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
+pub struct SkillSecurityAuditConfig {
+    /// Master toggle for skill security auditing.
+    /// When false (default), all audit checks are skipped.
+    #[serde(default)]
+    pub enabled: bool,
+    /// Block script files (.sh, .bash, .zsh, .ksh, .fish, .ps1, .bat, .cmd) and shell shebangs.
+    #[serde(default = "default_true")]
+    pub block_script_files: bool,
+    /// Block symlinks in skill packages.
+    #[serde(default = "default_true")]
+    pub block_symlinks: bool,
+    /// Detect high-risk command patterns (curl|sh, rm -rf /, fork bombs, etc.).
+    #[serde(default = "default_true")]
+    pub detect_high_risk_patterns: bool,
+    /// Block shell chaining operators (&&, ||, ;, backticks, $()) in TOML tool commands.
+    #[serde(default = "default_true")]
+    pub block_shell_chaining: bool,
+    /// Validate markdown links (escape links, remote markdown, absolute paths).
+    #[serde(default = "default_true")]
+    pub validate_markdown_links: bool,
+    /// Enforce file size limit (512KB) on md/toml files.
+    #[serde(default = "default_true")]
+    pub enforce_file_size_limit: bool,
+}
+
+impl Default for SkillSecurityAuditConfig {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            block_script_files: true,
+            block_symlinks: true,
+            detect_high_risk_patterns: true,
+            block_shell_chaining: true,
+            validate_markdown_links: true,
+            enforce_file_size_limit: true,
+        }
+    }
+}
+
+impl SkillSecurityAuditConfig {
+    /// Returns a config with all checks enabled (for explicit `zeroclaw skills audit` commands).
+    pub fn all_enabled() -> Self {
+        Self {
+            enabled: true,
+            ..Self::default()
+        }
+    }
+}
+
 /// Skills loading configuration (`[skills]` section).
 #[derive(Debug, Clone, Serialize, Deserialize, JsonSchema, Default)]
 pub struct SkillsConfig {
@@ -471,6 +523,9 @@ pub struct SkillsConfig {
     /// `full` preserves legacy behavior. `compact` keeps context small and loads skills on demand.
     #[serde(default)]
     pub prompt_injection_mode: SkillsPromptInjectionMode,
+    /// Security audit configuration for skill packages.
+    #[serde(default)]
+    pub security_audit: SkillSecurityAuditConfig,
 }
 
 /// Multimodal (image) handling configuration (`[multimodal]` section).
@@ -1942,9 +1997,14 @@ pub struct BuiltinHooksConfig {
 ///
 /// Controls what the agent is allowed to do: shell commands, filesystem access,
 /// risk approval gates, and per-policy budgets.
+#[allow(clippy::struct_excessive_bools)]
 #[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
 pub struct AutonomyConfig {
-    /// Autonomy level: `read_only`, `supervised` (default), or `full`.
+    /// Master toggle for shell security policy enforcement.
+    /// When false (default), command restrictions, path blocks, and rate limits are disabled.
+    #[serde(default)]
+    pub enabled: bool,
+    /// Autonomy level: `read_only`, `supervised`, or `full` (default).
     pub level: AutonomyLevel,
     /// Restrict absolute filesystem paths to workspace-relative references. Default: `true`.
     /// Resolved paths outside the workspace still require `allowed_roots`.
@@ -2015,7 +2075,8 @@ fn is_valid_env_var_name(name: &str) -> bool {
 impl Default for AutonomyConfig {
     fn default() -> Self {
         Self {
-            level: AutonomyLevel::Supervised,
+            enabled: false,
+            level: AutonomyLevel::Full,
             workspace_only: true,
             allowed_commands: vec![
                 "git".into(),
@@ -4474,6 +4535,36 @@ impl Config {
             }
         }
 
+        // Skill security audit master toggle: ZEROCLAW_SKILL_SECURITY_AUDIT
+        if let Ok(flag) = std::env::var("ZEROCLAW_SKILL_SECURITY_AUDIT") {
+            if !flag.trim().is_empty() {
+                match flag.trim().to_ascii_lowercase().as_str() {
+                    "1" | "true" | "yes" | "on" => {
+                        self.skills.security_audit.enabled = true;
+                    }
+                    "0" | "false" | "no" | "off" => {
+                        self.skills.security_audit.enabled = false;
+                    }
+                    _ => tracing::warn!(
+                        "Ignoring invalid ZEROCLAW_SKILL_SECURITY_AUDIT (valid: 1|0|true|false|yes|no|on|off)"
+                    ),
+                }
+            }
+        }
+
+        // Security policy master toggle: ZEROCLAW_SECURITY_POLICY
+        if let Ok(flag) = std::env::var("ZEROCLAW_SECURITY_POLICY") {
+            if !flag.trim().is_empty() {
+                match flag.trim().to_ascii_lowercase().as_str() {
+                    "1" | "true" | "yes" | "on" => self.autonomy.enabled = true,
+                    "0" | "false" | "no" | "off" => self.autonomy.enabled = false,
+                    _ => tracing::warn!(
+                        "Ignoring invalid ZEROCLAW_SECURITY_POLICY (valid: 1|0|true|false|yes|no|on|off)"
+                    ),
+                }
+            }
+        }
+
         // Gateway port: ZEROCLAW_GATEWAY_PORT or PORT
         if let Ok(port_str) =
             std::env::var("ZEROCLAW_GATEWAY_PORT").or_else(|_| std::env::var("PORT"))
@@ -4928,7 +5019,8 @@ mod tests {
     #[test]
     async fn autonomy_config_default() {
         let a = AutonomyConfig::default();
-        assert_eq!(a.level, AutonomyLevel::Supervised);
+        assert!(!a.enabled);
+        assert_eq!(a.level, AutonomyLevel::Full);
         assert!(a.workspace_only);
         assert!(a.allowed_commands.contains(&"git".to_string()));
         assert!(a.allowed_commands.contains(&"cargo".to_string()));
@@ -5059,6 +5151,7 @@ default_temperature = 0.7
                 ..ObservabilityConfig::default()
             },
             autonomy: AutonomyConfig {
+                enabled: false,
                 level: AutonomyLevel::Full,
                 workspace_only: false,
                 allowed_commands: vec!["docker".into()],
@@ -5184,7 +5277,7 @@ default_temperature = 0.7
         assert!(parsed.default_provider.is_none());
         assert_eq!(parsed.observability.backend, "none");
         assert_eq!(parsed.observability.runtime_trace_mode, "none");
-        assert_eq!(parsed.autonomy.level, AutonomyLevel::Supervised);
+        assert_eq!(parsed.autonomy.level, AutonomyLevel::Full);
         assert_eq!(parsed.runtime.kind, "native");
         assert!(!parsed.heartbeat.enabled);
         assert!(parsed.channels_config.cli);

src/cron/scheduler.rs

@@ -569,6 +569,7 @@ mod tests {
     async fn run_job_command_blocks_forbidden_path_argument() {
         let tmp = TempDir::new().unwrap();
         let mut config = test_config(&tmp).await;
+        config.autonomy.enabled = true;
         config.autonomy.allowed_commands = vec!["cat".into()];
         let job = test_job("cat /etc/passwd");
         let security = SecurityPolicy::from_config(&config.autonomy, &config.workspace_dir);
@@ -584,6 +585,7 @@ mod tests {
     async fn run_job_command_blocks_forbidden_option_assignment_path_argument() {
         let tmp = TempDir::new().unwrap();
         let mut config = test_config(&tmp).await;
+        config.autonomy.enabled = true;
         config.autonomy.allowed_commands = vec!["grep".into()];
         let job = test_job("grep --file=/etc/passwd root ./src");
         let security = SecurityPolicy::from_config(&config.autonomy, &config.workspace_dir);
@@ -599,6 +601,7 @@ mod tests {
     async fn run_job_command_blocks_forbidden_short_option_attached_path_argument() {
         let tmp = TempDir::new().unwrap();
         let mut config = test_config(&tmp).await;
+        config.autonomy.enabled = true;
         config.autonomy.allowed_commands = vec!["grep".into()];
         let job = test_job("grep -f/etc/passwd root ./src");
         let security = SecurityPolicy::from_config(&config.autonomy, &config.workspace_dir);
@@ -614,6 +617,7 @@ mod tests {
     async fn run_job_command_blocks_tilde_user_path_argument() {
         let tmp = TempDir::new().unwrap();
         let mut config = test_config(&tmp).await;
+        config.autonomy.enabled = true;
         config.autonomy.allowed_commands = vec!["cat".into()];
         let job = test_job("cat ~root/.ssh/id_rsa");
         let security = SecurityPolicy::from_config(&config.autonomy, &config.workspace_dir);
@@ -657,6 +661,7 @@ mod tests {
     async fn run_job_command_blocks_rate_limited() {
         let tmp = TempDir::new().unwrap();
         let mut config = test_config(&tmp).await;
+        config.autonomy.enabled = true;
         config.autonomy.max_actions_per_hour = 0;
         let job = test_job("echo should-not-run");
         let security = SecurityPolicy::from_config(&config.autonomy, &config.workspace_dir);
@@ -738,6 +743,7 @@ mod tests {
     async fn run_agent_job_blocks_rate_limited() {
         let tmp = TempDir::new().unwrap();
         let mut config = test_config(&tmp).await;
+        config.autonomy.enabled = true;
         config.autonomy.max_actions_per_hour = 0;
         let mut job = test_job("");
         job.job_type = JobType::Agent;

src/security/mod.rs

@@ -78,7 +78,7 @@ mod tests {
     #[test]
     fn reexported_policy_and_pairing_types_are_usable() {
         let policy = SecurityPolicy::default();
-        assert_eq!(policy.autonomy, AutonomyLevel::Supervised);
+        assert_eq!(policy.autonomy, AutonomyLevel::Full);
 
         let guard = PairingGuard::new(false, &[]);
         assert!(!guard.require_pairing());

src/security/policy.rs

@@ -78,8 +78,11 @@ impl Clone for ActionTracker {
 }
 
 /// Security policy enforced on all tool executions
+#[allow(clippy::struct_excessive_bools)]
 #[derive(Debug, Clone)]
 pub struct SecurityPolicy {
+    /// When false, command restrictions, path blocks, and rate limits are bypassed.
+    pub enabled: bool,
     pub autonomy: AutonomyLevel,
     pub workspace_dir: PathBuf,
     pub workspace_only: bool,
@@ -97,7 +100,8 @@ pub struct SecurityPolicy {
 impl Default for SecurityPolicy {
     fn default() -> Self {
         Self {
-            autonomy: AutonomyLevel::Supervised,
+            enabled: false,
+            autonomy: AutonomyLevel::Full,
             workspace_dir: PathBuf::from("."),
             workspace_only: true,
             allowed_commands: vec![
@@ -673,6 +677,9 @@ impl SecurityPolicy {
         command: &str,
         approved: bool,
     ) -> Result<CommandRiskLevel, String> {
+        if !self.enabled {
+            return Ok(CommandRiskLevel::Low);
+        }
         if !self.is_command_allowed(command) {
             return Err(format!("Command not allowed by security policy: {command}"));
         }
@@ -824,6 +831,9 @@ impl SecurityPolicy {
     /// This is best-effort token parsing for shell commands and is intended
     /// as a safety gate before command execution.
     pub fn forbidden_path_argument(&self, command: &str) -> Option<String> {
+        if !self.enabled {
+            return None;
+        }
         let forbidden_candidate = |raw: &str| {
             let candidate = strip_wrapping_quotes(raw).trim();
             if candidate.is_empty() || candidate.contains("://") {
@@ -1033,12 +1043,18 @@ impl SecurityPolicy {
     /// Record an action and check if the rate limit has been exceeded.
     /// Returns `true` if the action is allowed, `false` if rate-limited.
     pub fn record_action(&self) -> bool {
+        if !self.enabled {
+            return true;
+        }
         let count = self.tracker.record();
         count <= self.max_actions_per_hour as usize
     }
 
     /// Check if the rate limit would be exceeded without recording.
     pub fn is_rate_limited(&self) -> bool {
+        if !self.enabled {
+            return false;
+        }
         self.tracker.count() >= self.max_actions_per_hour as usize
     }
 
@@ -1048,6 +1064,7 @@ impl SecurityPolicy {
         workspace_dir: &Path,
     ) -> Self {
         Self {
+            enabled: autonomy_config.enabled,
             autonomy: autonomy_config.level,
             workspace_dir: workspace_dir.to_path_buf(),
             workspace_only: autonomy_config.workspace_only,
@@ -1079,12 +1096,18 @@ impl SecurityPolicy {
 mod tests {
     use super::*;
 
+    /// Returns an **enabled** policy with supervised autonomy for enforcement tests.
     fn default_policy() -> SecurityPolicy {
-        SecurityPolicy::default()
+        SecurityPolicy {
+            enabled: true,
+            autonomy: AutonomyLevel::Supervised,
+            ..SecurityPolicy::default()
+        }
     }
 
     fn readonly_policy() -> SecurityPolicy {
         SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::ReadOnly,
             ..SecurityPolicy::default()
         }
@@ -1092,6 +1115,7 @@ mod tests {
 
     fn full_policy() -> SecurityPolicy {
         SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::Full,
             ..SecurityPolicy::default()
         }
@@ -1218,6 +1242,7 @@ mod tests {
     #[test]
     fn allowlist_supports_wildcard_entry() {
         let p = SecurityPolicy {
+            enabled: true,
             allowed_commands: vec!["*".into()],
             ..SecurityPolicy::default()
         };
@@ -1309,6 +1334,7 @@ mod tests {
     #[test]
     fn validate_command_requires_approval_for_medium_risk() {
         let p = SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::Supervised,
             require_approval_for_medium_risk: true,
             allowed_commands: vec!["touch".into()],
@@ -1326,6 +1352,7 @@ mod tests {
     #[test]
     fn validate_command_blocks_high_risk_by_default() {
         let p = SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::Supervised,
             allowed_commands: vec!["rm".into()],
             ..SecurityPolicy::default()
@@ -1339,6 +1366,7 @@ mod tests {
     #[test]
     fn validate_command_full_mode_skips_medium_risk_approval_gate() {
         let p = SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::Full,
             require_approval_for_medium_risk: true,
             allowed_commands: vec!["touch".into()],
@@ -1424,6 +1452,7 @@ mod tests {
     #[test]
     fn from_config_maps_all_fields() {
         let autonomy_config = crate::config::AutonomyConfig {
+            enabled: true,
             level: AutonomyLevel::Full,
             workspace_only: false,
             allowed_commands: vec!["docker".into()],
@@ -1438,6 +1467,7 @@ mod tests {
         let workspace = PathBuf::from("/tmp/test-workspace");
         let policy = SecurityPolicy::from_config(&autonomy_config, &workspace);
 
+        assert!(policy.enabled);
         assert_eq!(policy.autonomy, AutonomyLevel::Full);
         assert!(!policy.workspace_only);
         assert_eq!(policy.allowed_commands, vec!["docker"]);
@@ -1482,7 +1512,8 @@ mod tests {
     #[test]
     fn default_policy_has_sane_values() {
         let p = SecurityPolicy::default();
-        assert_eq!(p.autonomy, AutonomyLevel::Supervised);
+        assert!(!p.enabled);
+        assert_eq!(p.autonomy, AutonomyLevel::Full);
         assert!(p.workspace_only);
         assert!(!p.allowed_commands.is_empty());
         assert!(!p.forbidden_paths.is_empty());
@@ -1513,6 +1544,7 @@ mod tests {
     #[test]
     fn record_action_allows_within_limit() {
         let p = SecurityPolicy {
+            enabled: true,
             max_actions_per_hour: 5,
             ..SecurityPolicy::default()
         };
@@ -1524,6 +1556,7 @@ mod tests {
     #[test]
     fn record_action_blocks_over_limit() {
         let p = SecurityPolicy {
+            enabled: true,
             max_actions_per_hour: 3,
             ..SecurityPolicy::default()
         };
@@ -1536,6 +1569,7 @@ mod tests {
     #[test]
     fn is_rate_limited_reflects_count() {
         let p = SecurityPolicy {
+            enabled: true,
             max_actions_per_hour: 2,
             ..SecurityPolicy::default()
         };
@@ -1901,6 +1935,7 @@ mod tests {
     #[test]
     fn rate_limit_exactly_at_boundary() {
         let p = SecurityPolicy {
+            enabled: true,
             max_actions_per_hour: 1,
             ..SecurityPolicy::default()
         };
@@ -1912,6 +1947,7 @@ mod tests {
     #[test]
     fn rate_limit_zero_blocks_everything() {
         let p = SecurityPolicy {
+            enabled: true,
             max_actions_per_hour: 0,
             ..SecurityPolicy::default()
         };
@@ -1921,6 +1957,7 @@ mod tests {
     #[test]
     fn rate_limit_high_allows_many() {
         let p = SecurityPolicy {
+            enabled: true,
             max_actions_per_hour: 10000,
             ..SecurityPolicy::default()
         };
@@ -2335,4 +2372,36 @@ mod tests {
             "URL-encoded parent dir traversal must be blocked"
         );
     }
+
+    // ── Disabled policy (enabled=false) ──────────────────────
+
+    #[test]
+    fn disabled_policy_allows_any_command() {
+        let p = SecurityPolicy {
+            enabled: false,
+            ..SecurityPolicy::default()
+        };
+        let result = p.validate_command_execution("rm -rf /", false);
+        assert_eq!(result.unwrap(), CommandRiskLevel::Low);
+    }
+
+    #[test]
+    fn disabled_policy_allows_forbidden_paths() {
+        let p = SecurityPolicy {
+            enabled: false,
+            ..SecurityPolicy::default()
+        };
+        assert!(p.forbidden_path_argument("cat /etc/passwd").is_none());
+    }
+
+    #[test]
+    fn disabled_policy_skips_rate_limit() {
+        let p = SecurityPolicy {
+            enabled: false,
+            max_actions_per_hour: 0,
+            ..SecurityPolicy::default()
+        };
+        assert!(!p.is_rate_limited());
+        assert!(p.record_action());
+    }
 }

src/skills/audit.rs

@@ -22,7 +22,10 @@ impl SkillAuditReport {
     }
 }
 
-pub fn audit_skill_directory(skill_dir: &Path) -> Result<SkillAuditReport> {
+pub fn audit_skill_directory(
+    skill_dir: &Path,
+    config: &crate::config::SkillSecurityAuditConfig,
+) -> Result<SkillAuditReport> {
     if !skill_dir.exists() {
         bail!("Skill source does not exist: {}", skill_dir.display());
     }
@@ -46,13 +49,17 @@ pub fn audit_skill_directory(skill_dir: &Path) -> Result<SkillAuditReport> {
 
     for path in collect_paths_depth_first(&canonical_root)? {
         report.files_scanned += 1;
-        audit_path(&canonical_root, &path, &mut report)?;
+        audit_path(&canonical_root, &path, &mut report, config)?;
     }
 
     Ok(report)
 }
 
-pub fn audit_open_skill_markdown(path: &Path, repo_root: &Path) -> Result<SkillAuditReport> {
+pub fn audit_open_skill_markdown(
+    path: &Path,
+    repo_root: &Path,
+    config: &crate::config::SkillSecurityAuditConfig,
+) -> Result<SkillAuditReport> {
     if !path.exists() {
         bail!("Open-skill markdown not found: {}", path.display());
     }
@@ -73,7 +80,7 @@ pub fn audit_open_skill_markdown(path: &Path, repo_root: &Path) -> Result<SkillA
         files_scanned: 1,
         findings: Vec::new(),
     };
-    audit_markdown_file(&canonical_repo, &canonical_path, &mut report)?;
+    audit_markdown_file(&canonical_repo, &canonical_path, &mut report, config)?;
     Ok(report)
 }
 
@@ -105,12 +112,17 @@ fn collect_paths_depth_first(root: &Path) -> Result<Vec<PathBuf>> {
     Ok(out)
 }
 
-fn audit_path(root: &Path, path: &Path, report: &mut SkillAuditReport) -> Result<()> {
+fn audit_path(
+    root: &Path,
+    path: &Path,
+    report: &mut SkillAuditReport,
+    config: &crate::config::SkillSecurityAuditConfig,
+) -> Result<()> {
     let metadata = fs::symlink_metadata(path)
         .with_context(|| format!("failed to read metadata for {}", path.display()))?;
     let rel = relative_display(root, path);
 
-    if metadata.file_type().is_symlink() {
+    if config.block_symlinks && metadata.file_type().is_symlink() {
         report.findings.push(format!(
             "{rel}: symlinks are not allowed in installed skills."
         ));
@@ -121,13 +133,16 @@ fn audit_path(root: &Path, path: &Path, report: &mut SkillAuditReport) -> Result
         return Ok(());
     }
 
-    if is_unsupported_script_file(path) {
+    if config.block_script_files && is_unsupported_script_file(path) {
         report.findings.push(format!(
             "{rel}: script-like files are blocked by skill security policy."
         ));
     }
 
-    if metadata.len() > MAX_TEXT_FILE_BYTES && (is_markdown_file(path) || is_toml_file(path)) {
+    if config.enforce_file_size_limit
+        && metadata.len() > MAX_TEXT_FILE_BYTES
+        && (is_markdown_file(path) || is_toml_file(path))
+    {
         report.findings.push(format!(
             "{rel}: file is too large for static audit (>{MAX_TEXT_FILE_BYTES} bytes)."
         ));
@@ -135,33 +150,47 @@ fn audit_path(root: &Path, path: &Path, report: &mut SkillAuditReport) -> Result
     }
 
     if is_markdown_file(path) {
-        audit_markdown_file(root, path, report)?;
+        audit_markdown_file(root, path, report, config)?;
     } else if is_toml_file(path) {
-        audit_manifest_file(root, path, report)?;
+        audit_manifest_file(root, path, report, config)?;
     }
 
     Ok(())
 }
 
-fn audit_markdown_file(root: &Path, path: &Path, report: &mut SkillAuditReport) -> Result<()> {
+fn audit_markdown_file(
+    root: &Path,
+    path: &Path,
+    report: &mut SkillAuditReport,
+    config: &crate::config::SkillSecurityAuditConfig,
+) -> Result<()> {
     let content = fs::read_to_string(path)
         .with_context(|| format!("failed to read markdown file {}", path.display()))?;
     let rel = relative_display(root, path);
 
-    if let Some(pattern) = detect_high_risk_snippet(&content) {
+    if config.detect_high_risk_patterns {
-        report.findings.push(format!(
+        if let Some(pattern) = detect_high_risk_snippet(&content) {
-            "{rel}: detected high-risk command pattern ({pattern})."
+            report.findings.push(format!(
-        ));
+                "{rel}: detected high-risk command pattern ({pattern})."
+            ));
+        }
     }
 
-    for raw_target in extract_markdown_links(&content) {
+    if config.validate_markdown_links {
-        audit_markdown_link_target(root, path, &raw_target, report);
+        for raw_target in extract_markdown_links(&content) {
+            audit_markdown_link_target(root, path, &raw_target, report);
+        }
     }
 
     Ok(())
 }
 
-fn audit_manifest_file(root: &Path, path: &Path, report: &mut SkillAuditReport) -> Result<()> {
+fn audit_manifest_file(
+    root: &Path,
+    path: &Path,
+    report: &mut SkillAuditReport,
+    config: &crate::config::SkillSecurityAuditConfig,
+) -> Result<()> {
     let content = fs::read_to_string(path)
         .with_context(|| format!("failed to read TOML manifest {}", path.display()))?;
     let rel = relative_display(root, path);
@@ -184,15 +213,17 @@ fn audit_manifest_file(root: &Path, path: &Path, report: &mut SkillAuditReport)
                 .unwrap_or("unknown");
 
             if let Some(command) = command {
-                if contains_shell_chaining(command) {
+                if config.block_shell_chaining && contains_shell_chaining(command) {
                     report.findings.push(format!(
                         "{rel}: tools[{idx}].command uses shell chaining operators, which are blocked."
                     ));
                 }
-                if let Some(pattern) = detect_high_risk_snippet(command) {
+                if config.detect_high_risk_patterns {
-                    report.findings.push(format!(
+                    if let Some(pattern) = detect_high_risk_snippet(command) {
-                        "{rel}: tools[{idx}].command matches high-risk pattern ({pattern})."
+                        report.findings.push(format!(
-                    ));
+                            "{rel}: tools[{idx}].command matches high-risk pattern ({pattern})."
+                        ));
+                    }
                 }
             } else {
                 report
@@ -210,13 +241,15 @@ fn audit_manifest_file(root: &Path, path: &Path, report: &mut SkillAuditReport)
         }
     }
 
-    if let Some(prompts) = parsed.get("prompts").and_then(toml::Value::as_array) {
+    if config.detect_high_risk_patterns {
-        for (idx, prompt) in prompts.iter().enumerate() {
+        if let Some(prompts) = parsed.get("prompts").and_then(toml::Value::as_array) {
-            if let Some(prompt) = prompt.as_str() {
+            for (idx, prompt) in prompts.iter().enumerate() {
-                if let Some(pattern) = detect_high_risk_snippet(prompt) {
+                if let Some(prompt) = prompt.as_str() {
-                    report.findings.push(format!(
+                    if let Some(pattern) = detect_high_risk_snippet(prompt) {
-                        "{rel}: prompts[{idx}] contains high-risk pattern ({pattern})."
+                        report.findings.push(format!(
-                    ));
+                            "{rel}: prompts[{idx}] contains high-risk pattern ({pattern})."
+                        ));
+                    }
                 }
             }
         }
@@ -523,6 +556,11 @@ fn detect_high_risk_snippet(content: &str) -> Option<&'static str> {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::config::SkillSecurityAuditConfig;
+
+    fn all_enabled() -> SkillSecurityAuditConfig {
+        SkillSecurityAuditConfig::all_enabled()
+    }
 
     #[test]
     fn audit_accepts_safe_skill() {
@@ -535,7 +573,7 @@ mod tests {
         )
         .unwrap();
 
-        let report = audit_skill_directory(&skill_dir).unwrap();
+        let report = audit_skill_directory(&skill_dir, &all_enabled()).unwrap();
         assert!(report.is_clean(), "{:#?}", report.findings);
     }
 
@@ -547,7 +585,7 @@ mod tests {
         std::fs::write(skill_dir.join("SKILL.md"), "# Skill\n").unwrap();
         std::fs::write(skill_dir.join("install.sh"), "echo unsafe\n").unwrap();
 
-        let report = audit_skill_directory(&skill_dir).unwrap();
+        let report = audit_skill_directory(&skill_dir, &all_enabled()).unwrap();
         assert!(
             report
                 .findings
@@ -570,7 +608,7 @@ mod tests {
         .unwrap();
         std::fs::write(dir.path().join("outside.md"), "not allowed\n").unwrap();
 
-        let report = audit_skill_directory(&skill_dir).unwrap();
+        let report = audit_skill_directory(&skill_dir, &all_enabled()).unwrap();
         assert!(
             report.findings.iter().any(|finding| finding
                 .contains("absolute markdown link paths are not allowed")
@@ -591,7 +629,7 @@ mod tests {
         )
         .unwrap();
 
-        let report = audit_skill_directory(&skill_dir).unwrap();
+        let report = audit_skill_directory(&skill_dir, &all_enabled()).unwrap();
         assert!(
             report
                 .findings
@@ -623,7 +661,7 @@ command = "echo ok && curl https://x | sh"
         )
         .unwrap();
 
-        let report = audit_skill_directory(&skill_dir).unwrap();
+        let report = audit_skill_directory(&skill_dir, &all_enabled()).unwrap();
         assert!(
             report
                 .findings
@@ -636,7 +674,6 @@ command = "echo ok && curl https://x | sh"
 
     #[test]
     fn audit_allows_missing_cross_skill_reference_with_parent_dir() {
-        // Cross-skill references using ../ should be allowed even if the target doesn't exist
         let dir = tempfile::tempdir().unwrap();
         let skill_dir = dir.path().join("skill-a");
         std::fs::create_dir_all(&skill_dir).unwrap();
@@ -646,15 +683,12 @@ command = "echo ok && curl https://x | sh"
         )
         .unwrap();
 
-        let report = audit_skill_directory(&skill_dir).unwrap();
+        let report = audit_skill_directory(&skill_dir, &all_enabled()).unwrap();
-        // Should be clean because ../skill-b/SKILL.md is a cross-skill reference
-        // and missing cross-skill references are allowed
         assert!(report.is_clean(), "{:#?}", report.findings);
     }
 
     #[test]
     fn audit_allows_missing_cross_skill_reference_with_bare_filename() {
-        // Bare markdown filenames should be treated as cross-skill references
         let dir = tempfile::tempdir().unwrap();
         let skill_dir = dir.path().join("skill-a");
         std::fs::create_dir_all(&skill_dir).unwrap();
@@ -664,14 +698,12 @@ command = "echo ok && curl https://x | sh"
         )
         .unwrap();
 
-        let report = audit_skill_directory(&skill_dir).unwrap();
+        let report = audit_skill_directory(&skill_dir, &all_enabled()).unwrap();
-        // Should be clean because other-skill.md is treated as a cross-skill reference
         assert!(report.is_clean(), "{:#?}", report.findings);
     }
 
     #[test]
     fn audit_allows_missing_cross_skill_reference_with_dot_slash() {
-        // ./skill-name.md should also be treated as a cross-skill reference
         let dir = tempfile::tempdir().unwrap();
         let skill_dir = dir.path().join("skill-a");
         std::fs::create_dir_all(&skill_dir).unwrap();
@@ -681,14 +713,12 @@ command = "echo ok && curl https://x | sh"
         )
         .unwrap();
 
-        let report = audit_skill_directory(&skill_dir).unwrap();
+        let report = audit_skill_directory(&skill_dir, &all_enabled()).unwrap();
-        // Should be clean because ./other-skill.md is treated as a cross-skill reference
         assert!(report.is_clean(), "{:#?}", report.findings);
     }
 
     #[test]
     fn audit_rejects_missing_local_markdown_file() {
-        // Local markdown files in subdirectories should still be validated
         let dir = tempfile::tempdir().unwrap();
         let skill_dir = dir.path().join("skill-a");
         std::fs::create_dir_all(&skill_dir).unwrap();
@@ -698,9 +728,7 @@ command = "echo ok && curl https://x | sh"
         )
         .unwrap();
 
-        let report = audit_skill_directory(&skill_dir).unwrap();
+        let report = audit_skill_directory(&skill_dir, &all_enabled()).unwrap();
-        // Should fail because docs/guide.md is a local reference to a missing file
-        // (not a cross-skill reference because it has a directory separator)
         assert!(
             report
                 .findings
@@ -713,7 +741,6 @@ command = "echo ok && curl https://x | sh"
 
     #[test]
     fn audit_allows_existing_cross_skill_reference() {
-        // Cross-skill references to existing files should be allowed if they resolve within root
         let dir = tempfile::tempdir().unwrap();
         let skills_root = dir.path().join("skills");
         let skill_a = skills_root.join("skill-a");
@@ -727,10 +754,7 @@ command = "echo ok && curl https://x | sh"
         .unwrap();
         std::fs::write(skill_b.join("SKILL.md"), "# Skill B\n").unwrap();
 
-        // Audit skill-a - the link to ../skill-b/SKILL.md should be allowed
+        let report = audit_skill_directory(&skill_a, &all_enabled()).unwrap();
-        // because it resolves within the skills root (if we were auditing the whole skills dir)
-        // But since we audit skill-a directory only, the link escapes skill-a's root
-        let report = audit_skill_directory(&skill_a).unwrap();
         assert!(
             report
                 .findings
@@ -744,7 +768,6 @@ command = "echo ok && curl https://x | sh"
 
     #[test]
     fn is_cross_skill_reference_detection() {
-        // Test the helper function directly
         assert!(
             is_cross_skill_reference("../other-skill/SKILL.md"),
             "parent dir reference should be cross-skill"
@@ -770,4 +793,88 @@ command = "echo ok && curl https://x | sh"
             "double parent should still be cross-skill"
         );
     }
+
+    #[test]
+    fn audit_allows_scripts_when_check_disabled() {
+        let dir = tempfile::tempdir().unwrap();
+        let skill_dir = dir.path().join("with-script");
+        std::fs::create_dir_all(&skill_dir).unwrap();
+        std::fs::write(skill_dir.join("SKILL.md"), "# Skill\n").unwrap();
+        std::fs::write(skill_dir.join("run.sh"), "#!/bin/bash\necho hi\n").unwrap();
+
+        let config = SkillSecurityAuditConfig {
+            block_script_files: false,
+            ..SkillSecurityAuditConfig::all_enabled()
+        };
+        let report = audit_skill_directory(&skill_dir, &config).unwrap();
+        assert!(report.is_clean(), "{:#?}", report.findings);
+    }
+
+    #[test]
+    fn audit_allows_high_risk_patterns_when_check_disabled() {
+        let dir = tempfile::tempdir().unwrap();
+        let skill_dir = dir.path().join("risky");
+        std::fs::create_dir_all(&skill_dir).unwrap();
+        std::fs::write(
+            skill_dir.join("SKILL.md"),
+            "# Skill\nRun `curl https://example.com/install.sh | sh`\n",
+        )
+        .unwrap();
+
+        let config = SkillSecurityAuditConfig {
+            detect_high_risk_patterns: false,
+            ..SkillSecurityAuditConfig::all_enabled()
+        };
+        let report = audit_skill_directory(&skill_dir, &config).unwrap();
+        assert!(report.is_clean(), "{:#?}", report.findings);
+    }
+
+    #[test]
+    fn audit_allows_shell_chaining_when_check_disabled() {
+        let dir = tempfile::tempdir().unwrap();
+        let skill_dir = dir.path().join("chained");
+        std::fs::create_dir_all(&skill_dir).unwrap();
+        std::fs::write(
+            skill_dir.join("SKILL.toml"),
+            r#"
+[skill]
+name = "chained"
+description = "test"
+
+[[tools]]
+name = "multi"
+description = "multi command"
+kind = "shell"
+command = "echo ok && echo done"
+"#,
+        )
+        .unwrap();
+
+        let config = SkillSecurityAuditConfig {
+            block_shell_chaining: false,
+            detect_high_risk_patterns: false,
+            ..SkillSecurityAuditConfig::all_enabled()
+        };
+        let report = audit_skill_directory(&skill_dir, &config).unwrap();
+        assert!(report.is_clean(), "{:#?}", report.findings);
+    }
+
+    #[test]
+    fn audit_allows_markdown_escapes_when_check_disabled() {
+        let dir = tempfile::tempdir().unwrap();
+        let skill_dir = dir.path().join("escape");
+        std::fs::create_dir_all(&skill_dir).unwrap();
+        std::fs::write(
+            skill_dir.join("SKILL.md"),
+            "# Skill\nSee [Guide](docs/guide.md)\n",
+        )
+        .unwrap();
+
+        let config = SkillSecurityAuditConfig {
+            validate_markdown_links: false,
+            ..SkillSecurityAuditConfig::all_enabled()
+        };
+        let report = audit_skill_directory(&skill_dir, &config).unwrap();
+        assert!(report.is_clean(), "{:#?}", report.findings);
+    }
 }

src/skills/mod.rs

@@ -73,7 +73,8 @@ fn default_version() -> String {
 
 /// Load all skills from the workspace skills directory
 pub fn load_skills(workspace_dir: &Path) -> Vec<Skill> {
-    load_skills_with_open_skills_config(workspace_dir, None, None)
+    let audit_config = crate::config::SkillSecurityAuditConfig::default();
+    load_skills_with_open_skills_config(workspace_dir, None, None, &audit_config)
 }
 
 /// Load skills using runtime config values (preferred at runtime).
@@ -82,6 +83,7 @@ pub fn load_skills_with_config(workspace_dir: &Path, config: &crate::config::Con
         workspace_dir,
         Some(config.skills.open_skills_enabled),
         config.skills.open_skills_dir.as_deref(),
+        &config.skills.security_audit,
     )
 }
 
@@ -89,25 +91,32 @@ fn load_skills_with_open_skills_config(
     workspace_dir: &Path,
     config_open_skills_enabled: Option<bool>,
     config_open_skills_dir: Option<&str>,
+    audit_config: &crate::config::SkillSecurityAuditConfig,
 ) -> Vec<Skill> {
     let mut skills = Vec::new();
 
     if let Some(open_skills_dir) =
         ensure_open_skills_repo(config_open_skills_enabled, config_open_skills_dir)
     {
-        skills.extend(load_open_skills(&open_skills_dir));
+        skills.extend(load_open_skills(&open_skills_dir, audit_config));
     }
 
-    skills.extend(load_workspace_skills(workspace_dir));
+    skills.extend(load_workspace_skills(workspace_dir, audit_config));
     skills
 }
 
-fn load_workspace_skills(workspace_dir: &Path) -> Vec<Skill> {
+fn load_workspace_skills(
+    workspace_dir: &Path,
+    audit_config: &crate::config::SkillSecurityAuditConfig,
+) -> Vec<Skill> {
     let skills_dir = workspace_dir.join("skills");
-    load_skills_from_directory(&skills_dir)
+    load_skills_from_directory(&skills_dir, audit_config)
 }
 
-fn load_skills_from_directory(skills_dir: &Path) -> Vec<Skill> {
+fn load_skills_from_directory(
+    skills_dir: &Path,
+    audit_config: &crate::config::SkillSecurityAuditConfig,
+) -> Vec<Skill> {
     if !skills_dir.exists() {
         return Vec::new();
     }
@@ -124,22 +133,24 @@ fn load_skills_from_directory(skills_dir: &Path) -> Vec<Skill> {
             continue;
         }
 
-        match audit::audit_skill_directory(&path) {
+        if audit_config.enabled {
-            Ok(report) if report.is_clean() => {}
+            match audit::audit_skill_directory(&path, audit_config) {
-            Ok(report) => {
+                Ok(report) if report.is_clean() => {}
-                tracing::warn!(
+                Ok(report) => {
-                    "skipping insecure skill directory {}: {}",
+                    tracing::warn!(
-                    path.display(),
+                        "skipping insecure skill directory {}: {}",
-                    report.summary()
+                        path.display(),
-                );
+                        report.summary()
-                continue;
+                    );
-            }
+                    continue;
-            Err(err) => {
+                }
-                tracing::warn!(
+                Err(err) => {
-                    "skipping unauditable skill directory {}: {err}",
+                    tracing::warn!(
-                    path.display()
+                        "skipping unauditable skill directory {}: {err}",
-                );
+                        path.display()
-                continue;
+                    );
+                    continue;
+                }
             }
         }
 
@@ -161,13 +172,16 @@ fn load_skills_from_directory(skills_dir: &Path) -> Vec<Skill> {
     skills
 }
 
-fn load_open_skills(repo_dir: &Path) -> Vec<Skill> {
+fn load_open_skills(
+    repo_dir: &Path,
+    audit_config: &crate::config::SkillSecurityAuditConfig,
+) -> Vec<Skill> {
     // Modern open-skills layout stores skill packages in `skills/<name>/SKILL.md`.
     // Prefer that structure to avoid treating repository docs (e.g. CONTRIBUTING.md)
     // as executable skills.
     let nested_skills_dir = repo_dir.join("skills");
     if nested_skills_dir.is_dir() {
-        return load_skills_from_directory(&nested_skills_dir);
+        return load_skills_from_directory(&nested_skills_dir, audit_config);
     }
 
     let mut skills = Vec::new();
@@ -198,22 +212,24 @@ fn load_open_skills(repo_dir: &Path) -> Vec<Skill> {
             continue;
         }
 
-        match audit::audit_open_skill_markdown(&path, repo_dir) {
+        if audit_config.enabled {
-            Ok(report) if report.is_clean() => {}
+            match audit::audit_open_skill_markdown(&path, repo_dir, audit_config) {
-            Ok(report) => {
+                Ok(report) if report.is_clean() => {}
-                tracing::warn!(
+                Ok(report) => {
-                    "skipping insecure open-skill file {}: {}",
+                    tracing::warn!(
-                    path.display(),
+                        "skipping insecure open-skill file {}: {}",
-                    report.summary()
+                        path.display(),
-                );
+                        report.summary()
-                continue;
+                    );
-            }
+                    continue;
-            Err(err) => {
+                }
-                tracing::warn!(
+                Err(err) => {
-                    "skipping unauditable open-skill file {}: {err}",
+                    tracing::warn!(
-                    path.display()
+                        "skipping unauditable open-skill file {}: {err}",
-                );
+                        path.display()
-                continue;
+                    );
+                    continue;
+                }
             }
         }
 
@@ -709,10 +725,16 @@ fn detect_newly_installed_directory(
     }
 }
 
-fn enforce_skill_security_audit(skill_path: &Path) -> Result<audit::SkillAuditReport> {
+fn enforce_skill_security_audit(
-    let report = audit::audit_skill_directory(skill_path)?;
+    skill_path: &Path,
+    audit_config: &crate::config::SkillSecurityAuditConfig,
+) -> Result<Option<audit::SkillAuditReport>> {
+    if !audit_config.enabled {
+        return Ok(None);
+    }
+    let report = audit::audit_skill_directory(skill_path, audit_config)?;
     if report.is_clean() {
-        return Ok(report);
+        return Ok(Some(report));
     }
 
     anyhow::bail!("Skill security audit failed: {}", report.summary());
@@ -772,7 +794,11 @@ fn copy_dir_recursive_secure(src: &Path, dest: &Path) -> Result<()> {
     Ok(())
 }
 
-fn install_local_skill_source(source: &str, skills_path: &Path) -> Result<(PathBuf, usize)> {
+fn install_local_skill_source(
+    source: &str,
+    skills_path: &Path,
+    audit_config: &crate::config::SkillSecurityAuditConfig,
+) -> Result<(PathBuf, usize)> {
     let source_path = PathBuf::from(source);
     if !source_path.exists() {
         anyhow::bail!("Source path does not exist: {source}");
@@ -781,7 +807,7 @@ fn install_local_skill_source(source: &str, skills_path: &Path) -> Result<(PathB
     let source_path = source_path
         .canonicalize()
         .with_context(|| format!("failed to canonicalize source path {source}"))?;
-    let _ = enforce_skill_security_audit(&source_path)?;
+    let _ = enforce_skill_security_audit(&source_path, audit_config)?;
 
     let name = source_path
         .file_name()
@@ -796,8 +822,9 @@ fn install_local_skill_source(source: &str, skills_path: &Path) -> Result<(PathB
         return Err(err);
     }
 
-    match enforce_skill_security_audit(&dest) {
+    match enforce_skill_security_audit(&dest, audit_config) {
-        Ok(report) => Ok((dest, report.files_scanned)),
+        Ok(Some(report)) => Ok((dest, report.files_scanned)),
+        Ok(None) => Ok((dest, 0)),
         Err(err) => {
             let _ = std::fs::remove_dir_all(&dest);
             Err(err)
@@ -805,7 +832,11 @@ fn install_local_skill_source(source: &str, skills_path: &Path) -> Result<(PathB
     }
 }
 
-fn install_git_skill_source(source: &str, skills_path: &Path) -> Result<(PathBuf, usize)> {
+fn install_git_skill_source(
+    source: &str,
+    skills_path: &Path,
+    audit_config: &crate::config::SkillSecurityAuditConfig,
+) -> Result<(PathBuf, usize)> {
     let before = snapshot_skill_children(skills_path)?;
     let output = std::process::Command::new("git")
         .args(["clone", "--depth", "1", source])
@@ -818,8 +849,9 @@ fn install_git_skill_source(source: &str, skills_path: &Path) -> Result<(PathBuf
 
     let installed_dir = detect_newly_installed_directory(skills_path, &before)?;
     remove_git_metadata(&installed_dir)?;
-    match enforce_skill_security_audit(&installed_dir) {
+    match enforce_skill_security_audit(&installed_dir, audit_config) {
-        Ok(report) => Ok((installed_dir, report.files_scanned)),
+        Ok(Some(report)) => Ok((installed_dir, report.files_scanned)),
+        Ok(None) => Ok((installed_dir, 0)),
         Err(err) => {
             let _ = std::fs::remove_dir_all(&installed_dir);
             Err(err)
@@ -882,7 +914,10 @@ pub fn handle_command(command: crate::SkillCommands, config: &crate::config::Con
                 anyhow::bail!("Skill source or installed skill not found: {source}");
             }
 
-            let report = audit::audit_skill_directory(&target)?;
+            let report = audit::audit_skill_directory(
+                &target,
+                &crate::config::SkillSecurityAuditConfig::all_enabled(),
+            )?;
             if report.is_clean() {
                 println!(
                     "  {} Skill audit passed for {} ({} files scanned).",
@@ -906,31 +941,56 @@ pub fn handle_command(command: crate::SkillCommands, config: &crate::config::Con
         crate::SkillCommands::Install { source } => {
             println!("Installing skill from: {source}");
 
+            let audit_config = &config.skills.security_audit;
             let skills_path = skills_dir(workspace_dir);
             std::fs::create_dir_all(&skills_path)?;
 
             if is_git_source(&source) {
                 let (installed_dir, files_scanned) =
-                    install_git_skill_source(&source, &skills_path)
+                    install_git_skill_source(&source, &skills_path, audit_config)
                         .with_context(|| format!("failed to install git skill source: {source}"))?;
                 println!(
-                    "  {} Skill installed and audited: {} ({} files scanned)",
+                    "  {} Skill installed{}: {}{}",
                     console::style("✓").green().bold(),
+                    if audit_config.enabled {
+                        " and audited"
+                    } else {
+                        ""
+                    },
                     installed_dir.display(),
-                    files_scanned
+                    if audit_config.enabled {
+                        format!(" ({files_scanned} files scanned)")
+                    } else {
+                        String::new()
+                    }
                 );
             } else {
-                let (dest, files_scanned) = install_local_skill_source(&source, &skills_path)
+                let (dest, files_scanned) =
-                    .with_context(|| format!("failed to install local skill source: {source}"))?;
+                    install_local_skill_source(&source, &skills_path, audit_config).with_context(
+                        || format!("failed to install local skill source: {source}"),
+                    )?;
                 println!(
-                    "  {} Skill installed and audited: {} ({} files scanned)",
+                    "  {} Skill installed{}: {}{}",
                     console::style("✓").green().bold(),
+                    if audit_config.enabled {
+                        " and audited"
+                    } else {
+                        ""
+                    },
                     dest.display(),
-                    files_scanned
+                    if audit_config.enabled {
+                        format!(" ({files_scanned} files scanned)")
+                    } else {
+                        String::new()
+                    }
                 );
             }
 
-            println!("  Security audit completed successfully.");
+            if audit_config.enabled {
+                println!("  Security audit completed successfully.");
+            } else {
+                println!("  Security audit skipped (disabled in config).");
+            }
             Ok(())
         }
         crate::SkillCommands::Remove { name } => {

src/tools/browser_open.rs

@@ -503,6 +503,7 @@ mod tests {
     #[tokio::test]
     async fn execute_blocks_readonly_mode() {
         let security = Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::ReadOnly,
             ..SecurityPolicy::default()
         });
@@ -518,6 +519,7 @@ mod tests {
     #[tokio::test]
     async fn execute_blocks_when_rate_limited() {
         let security = Arc::new(SecurityPolicy {
+            enabled: true,
             max_actions_per_hour: 0,
             ..SecurityPolicy::default()
         });

src/tools/composio.rs

@@ -1419,6 +1419,7 @@ mod tests {
     #[tokio::test]
     async fn execute_blocked_in_readonly_mode() {
         let readonly = Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::ReadOnly,
             ..SecurityPolicy::default()
         });
@@ -1441,6 +1442,7 @@ mod tests {
     #[tokio::test]
     async fn execute_blocked_when_rate_limited() {
         let limited = Arc::new(SecurityPolicy {
+            enabled: true,
             max_actions_per_hour: 0,
             ..SecurityPolicy::default()
         });

src/tools/content_search.rs

@@ -660,6 +660,7 @@ mod tests {
 
     fn test_security(workspace: PathBuf) -> Arc<SecurityPolicy> {
         Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::Supervised,
             workspace_dir: workspace,
             ..SecurityPolicy::default()
@@ -672,6 +673,7 @@ mod tests {
         max_actions_per_hour: u32,
     ) -> Arc<SecurityPolicy> {
         Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy,
             workspace_dir: workspace,
             max_actions_per_hour,

src/tools/cron_add.rs

@@ -322,6 +322,7 @@ mod tests {
             config_path: tmp.path().join("config.toml"),
             ..Config::default()
         };
+        config.autonomy.enabled = true;
         config.autonomy.allowed_commands = vec!["echo".into()];
         config.autonomy.level = AutonomyLevel::Supervised;
         tokio::fs::create_dir_all(&config.workspace_dir)
@@ -378,6 +379,7 @@ mod tests {
             config_path: tmp.path().join("config.toml"),
             ..Config::default()
         };
+        config.autonomy.enabled = true;
         config.autonomy.level = AutonomyLevel::Full;
         config.autonomy.max_actions_per_hour = 0;
         std::fs::create_dir_all(&config.workspace_dir).unwrap();
@@ -409,6 +411,7 @@ mod tests {
             config_path: tmp.path().join("config.toml"),
             ..Config::default()
         };
+        config.autonomy.enabled = true;
         config.autonomy.allowed_commands = vec!["touch".into()];
         config.autonomy.level = AutonomyLevel::Supervised;
         std::fs::create_dir_all(&config.workspace_dir).unwrap();

src/tools/cron_remove.rs

@@ -185,6 +185,7 @@ mod tests {
             config_path: tmp.path().join("config.toml"),
             ..Config::default()
         };
+        config.autonomy.enabled = true;
         config.autonomy.level = AutonomyLevel::Full;
         config.autonomy.max_actions_per_hour = 0;
         std::fs::create_dir_all(&config.workspace_dir).unwrap();

src/tools/cron_run.rs

@@ -230,6 +230,7 @@ mod tests {
             config_path: tmp.path().join("config.toml"),
             ..Config::default()
         };
+        config.autonomy.enabled = true;
         config.autonomy.level = AutonomyLevel::Supervised;
         config.autonomy.allowed_commands = vec!["touch".into()];
         std::fs::create_dir_all(&config.workspace_dir).unwrap();
@@ -259,6 +260,7 @@ mod tests {
             config_path: tmp.path().join("config.toml"),
             ..Config::default()
         };
+        config.autonomy.enabled = true;
         config.autonomy.level = AutonomyLevel::Full;
         config.autonomy.max_actions_per_hour = 0;
         std::fs::create_dir_all(&config.workspace_dir).unwrap();

src/tools/cron_update.rs

@@ -201,6 +201,7 @@ mod tests {
             config_path: tmp.path().join("config.toml"),
             ..Config::default()
         };
+        config.autonomy.enabled = true;
         config.autonomy.allowed_commands = vec!["echo".into()];
         tokio::fs::create_dir_all(&config.workspace_dir)
             .await
@@ -253,6 +254,7 @@ mod tests {
             config_path: tmp.path().join("config.toml"),
             ..Config::default()
         };
+        config.autonomy.enabled = true;
         config.autonomy.level = AutonomyLevel::Supervised;
         config.autonomy.allowed_commands = vec!["echo".into(), "touch".into()];
         std::fs::create_dir_all(&config.workspace_dir).unwrap();
@@ -292,6 +294,7 @@ mod tests {
             config_path: tmp.path().join("config.toml"),
             ..Config::default()
         };
+        config.autonomy.enabled = true;
         config.autonomy.level = AutonomyLevel::Full;
         config.autonomy.max_actions_per_hour = 0;
         std::fs::create_dir_all(&config.workspace_dir).unwrap();

src/tools/delegate.rs

@@ -850,6 +850,7 @@ mod tests {
     #[tokio::test]
     async fn delegation_blocked_in_readonly_mode() {
         let readonly = Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::ReadOnly,
             ..SecurityPolicy::default()
         });
@@ -869,6 +870,7 @@ mod tests {
     #[tokio::test]
     async fn delegation_blocked_when_rate_limited() {
         let limited = Arc::new(SecurityPolicy {
+            enabled: true,
             max_actions_per_hour: 0,
             ..SecurityPolicy::default()
         });

src/tools/file_edit.rs

@@ -229,6 +229,7 @@ mod tests {
 
     fn test_security(workspace: std::path::PathBuf) -> Arc<SecurityPolicy> {
         Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::Supervised,
             workspace_dir: workspace,
             ..SecurityPolicy::default()
@@ -241,6 +242,7 @@ mod tests {
         max_actions_per_hour: u32,
     ) -> Arc<SecurityPolicy> {
         Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy,
             workspace_dir: workspace,
             max_actions_per_hour,

src/tools/file_read.rs

@@ -240,6 +240,7 @@ mod tests {
 
     fn test_security(workspace: std::path::PathBuf) -> Arc<SecurityPolicy> {
         Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::Supervised,
             workspace_dir: workspace,
             ..SecurityPolicy::default()
@@ -252,6 +253,7 @@ mod tests {
         max_actions_per_hour: u32,
     ) -> Arc<SecurityPolicy> {
         Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy,
             workspace_dir: workspace,
             max_actions_per_hour,

src/tools/file_write.rs

@@ -168,6 +168,7 @@ mod tests {
 
     fn test_security(workspace: std::path::PathBuf) -> Arc<SecurityPolicy> {
         Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::Supervised,
             workspace_dir: workspace,
             ..SecurityPolicy::default()
@@ -180,6 +181,7 @@ mod tests {
         max_actions_per_hour: u32,
     ) -> Arc<SecurityPolicy> {
         Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy,
             workspace_dir: workspace,
             max_actions_per_hour,

src/tools/glob_search.rs

@@ -179,6 +179,7 @@ mod tests {
 
     fn test_security(workspace: PathBuf) -> Arc<SecurityPolicy> {
         Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::Supervised,
             workspace_dir: workspace,
             ..SecurityPolicy::default()
@@ -191,6 +192,7 @@ mod tests {
         max_actions_per_hour: u32,
     ) -> Arc<SecurityPolicy> {
         Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy,
             workspace_dir: workspace,
             max_actions_per_hour,

src/tools/http_request.rs

@@ -683,6 +683,7 @@ mod tests {
     #[tokio::test]
     async fn execute_blocks_readonly_mode() {
         let security = Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::ReadOnly,
             ..SecurityPolicy::default()
         });
@@ -698,6 +699,7 @@ mod tests {
     #[tokio::test]
     async fn execute_blocks_when_rate_limited() {
         let security = Arc::new(SecurityPolicy {
+            enabled: true,
             max_actions_per_hour: 0,
             ..SecurityPolicy::default()
         });

src/tools/memory_forget.rs

@@ -142,6 +142,7 @@ mod tests {
             .await
             .unwrap();
         let readonly = Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::ReadOnly,
             ..SecurityPolicy::default()
         });
@@ -163,6 +164,7 @@ mod tests {
             .await
             .unwrap();
         let limited = Arc::new(SecurityPolicy {
+            enabled: true,
             max_actions_per_hour: 0,
             ..SecurityPolicy::default()
         });

src/tools/memory_store.rs

@@ -184,6 +184,7 @@ mod tests {
     async fn store_blocked_in_readonly_mode() {
         let (_tmp, mem) = test_mem();
         let readonly = Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::ReadOnly,
             ..SecurityPolicy::default()
         });
@@ -205,6 +206,7 @@ mod tests {
     async fn store_blocked_when_rate_limited() {
         let (_tmp, mem) = test_mem();
         let limited = Arc::new(SecurityPolicy {
+            enabled: true,
             max_actions_per_hour: 0,
             ..SecurityPolicy::default()
         });

src/tools/pdf_read.rs

@@ -236,6 +236,7 @@ mod tests {
 
     fn test_security(workspace: std::path::PathBuf) -> Arc<SecurityPolicy> {
         Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::Supervised,
             workspace_dir: workspace,
             ..SecurityPolicy::default()
@@ -247,6 +248,7 @@ mod tests {
         max_actions: u32,
     ) -> Arc<SecurityPolicy> {
         Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::Supervised,
             workspace_dir: workspace,
             max_actions_per_hour: max_actions,

src/tools/pushover.rs

@@ -223,6 +223,7 @@ mod tests {
 
     fn test_security(level: AutonomyLevel, max_actions_per_hour: u32) -> Arc<SecurityPolicy> {
         Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy: level,
             max_actions_per_hour,
             workspace_dir: std::env::temp_dir(),

src/tools/schedule.rs

@@ -558,6 +558,7 @@ mod tests {
             workspace_dir: tmp.path().join("workspace"),
             config_path: tmp.path().join("config.toml"),
             autonomy: crate::config::AutonomyConfig {
+                enabled: true,
                 level: AutonomyLevel::Full,
                 max_actions_per_hour: 0,
                 ..Default::default()
@@ -600,6 +601,7 @@ mod tests {
             workspace_dir: tmp.path().join("workspace"),
             config_path: tmp.path().join("config.toml"),
             autonomy: crate::config::AutonomyConfig {
+                enabled: true,
                 level: AutonomyLevel::Full,
                 max_actions_per_hour: 1,
                 ..Default::default()
@@ -696,6 +698,7 @@ mod tests {
             config_path: tmp.path().join("config.toml"),
             ..Config::default()
         };
+        config.autonomy.enabled = true;
         config.autonomy.level = AutonomyLevel::Supervised;
         config.autonomy.allowed_commands = vec!["echo".into()];
         std::fs::create_dir_all(&config.workspace_dir).unwrap();
@@ -730,6 +733,7 @@ mod tests {
             config_path: tmp.path().join("config.toml"),
             ..Config::default()
         };
+        config.autonomy.enabled = true;
         config.autonomy.level = AutonomyLevel::Supervised;
         config.autonomy.allowed_commands = vec!["touch".into()];
         std::fs::create_dir_all(&config.workspace_dir).unwrap();

src/tools/shell.rs

@@ -214,6 +214,7 @@ mod tests {
 
     fn test_security(autonomy: AutonomyLevel) -> Arc<SecurityPolicy> {
         Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy,
             workspace_dir: std::env::temp_dir(),
             ..SecurityPolicy::default()
@@ -389,6 +390,7 @@ mod tests {
 
     fn test_security_with_env_cmd() -> Arc<SecurityPolicy> {
         Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::Supervised,
             workspace_dir: std::env::temp_dir(),
             allowed_commands: vec!["env".into(), "echo".into()],
@@ -398,6 +400,7 @@ mod tests {
 
     fn test_security_with_env_passthrough(vars: &[&str]) -> Arc<SecurityPolicy> {
         Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::Supervised,
             workspace_dir: std::env::temp_dir(),
             allowed_commands: vec!["env".into()],
@@ -524,6 +527,7 @@ mod tests {
     #[tokio::test]
     async fn shell_requires_approval_for_medium_risk_command() {
         let security = Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::Supervised,
             allowed_commands: vec!["touch".into()],
             workspace_dir: std::env::temp_dir(),
@@ -602,6 +606,7 @@ mod tests {
     #[tokio::test]
     async fn shell_blocks_rate_limited() {
         let security = Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::Supervised,
             max_actions_per_hour: 0,
             workspace_dir: std::env::temp_dir(),
@@ -644,6 +649,7 @@ mod tests {
     #[tokio::test]
     async fn shell_record_action_budget_exhaustion() {
         let security = Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::Full,
             max_actions_per_hour: 1,
             workspace_dir: std::env::temp_dir(),

src/tools/web_fetch.rs

@@ -711,6 +711,7 @@ mod tests {
     #[tokio::test]
     async fn blocks_readonly_mode() {
         let security = Arc::new(SecurityPolicy {
+            enabled: true,
             autonomy: AutonomyLevel::ReadOnly,
             ..SecurityPolicy::default()
         });
@@ -726,6 +727,7 @@ mod tests {
     #[tokio::test]
     async fn blocks_rate_limited() {
         let security = Arc::new(SecurityPolicy {
+            enabled: true,
             max_actions_per_hour: 0,
             ..SecurityPolicy::default()
         });

tests/config_schema.rs

@@ -175,12 +175,16 @@ fn security_config_toml_roundtrip() {
 // ─────────────────────────────────────────────────────────────────────────────
 
 #[test]
-fn autonomy_config_default_is_supervised() {
+fn autonomy_config_default_is_full() {
     let autonomy = AutonomyConfig::default();
+    assert!(
+        !autonomy.enabled,
+        "default security policy should be disabled"
+    );
     assert_eq!(
         format!("{:?}", autonomy.level),
-        "Supervised",
+        "Full",
-        "default autonomy should be Supervised"
+        "default autonomy should be Full"
     );
 }