skilllite 0.1.0__py3-none-any.whl → 0.1.2__py3-none-any.whl

skilllite/mcp/server.py

@@ -4,15 +4,22 @@ MCP Server implementation for SkillLite.
 This module provides a secure code execution sandbox server implementing
 the Model Context Protocol (MCP).
 
+Features:
+    1. **Skills Management**: List, inspect, and execute pre-defined skills
+       from the skills directory.
+
+    2. **Code Execution**: Execute arbitrary code in a secure sandbox with
+       security scanning.
+
 Security Model:
     The MCP server implements a two-phase execution model for security:
-    
+
     1. **scan_code**: First, scan the code for security issues. This returns
        a detailed report of any potential risks found in the code.
-    
+
     2. **execute_code**: Then, execute the code. If security issues were found,
        the caller must explicitly set `confirmed=true` to proceed.
-    
+
     This allows LLM clients to present security warnings to users and get
     explicit confirmation before executing potentially dangerous code.
 
@@ -20,6 +27,7 @@ Environment Variables:
     SKILLBOX_SANDBOX_LEVEL: Default sandbox level (1/2/3, default: 3)
     SKILLBOX_PATH: Path to skillbox binary
     MCP_SANDBOX_TIMEOUT: Execution timeout in seconds (default: 30)
+    SKILLLITE_SKILLS_DIR: Directory containing skills (default: ./.skills)
 """
 
 import asyncio
@@ -90,7 +98,27 @@ except ImportError:
 
 class SecurityScanResult:
     """Result of a security scan."""
-    
+
+    # Issue types that are HARD BLOCKED in L3 sandbox (cannot execute even with confirmation)
+    # These operations are blocked at the sandbox runtime level, not just static analysis
+    HARD_BLOCKED_ISSUE_TYPES_L3 = {
+        "Process Execution",   # os.system, subprocess, etc.
+        "ProcessExecution",    # Alternative format
+        "process_execution",   # Snake case format
+    }
+
+    # Rule IDs that are specifically hard blocked in L3 sandbox
+    HARD_BLOCKED_RULE_IDS_L3 = {
+        "py-subprocess",       # subprocess.call/run/Popen
+        "py-os-system",        # os.system/popen/spawn
+        "js-child-process",    # child_process.exec/spawn
+    }
+
+    # Dangerous module imports that lead to hard blocks when combined with execution
+    HARD_BLOCKED_MODULES_L3 = {
+        "py-os-import",        # import os/subprocess/shutil
+    }
+
     def __init__(
         self,
         is_safe: bool,
@@ -100,6 +128,7 @@ class SecurityScanResult:
         high_severity_count: int = 0,
         medium_severity_count: int = 0,
         low_severity_count: int = 0,
+        sandbox_level: int = 3,
     ):
         self.is_safe = is_safe
         self.issues = issues
@@ -108,8 +137,31 @@ class SecurityScanResult:
         self.high_severity_count = high_severity_count
         self.medium_severity_count = medium_severity_count
         self.low_severity_count = low_severity_count
+        self.sandbox_level = sandbox_level
         self.timestamp = time.time()
-    
+
+        # Calculate hard blocked issues
+        self.hard_blocked_issues = self._find_hard_blocked_issues()
+        self.has_hard_blocked = len(self.hard_blocked_issues) > 0
+
+    def _find_hard_blocked_issues(self) -> List[Dict[str, Any]]:
+        """Find issues that are hard blocked in the current sandbox level."""
+        if self.sandbox_level < 3:
+            # Only L3 has hard blocks
+            return []
+
+        hard_blocked = []
+        for issue in self.issues:
+            issue_type = issue.get("issue_type", "")
+            rule_id = issue.get("rule_id", "")
+
+            # Check if this issue type or rule is hard blocked
+            if (issue_type in self.HARD_BLOCKED_ISSUE_TYPES_L3 or
+                rule_id in self.HARD_BLOCKED_RULE_IDS_L3):
+                hard_blocked.append(issue)
+
+        return hard_blocked
+
     def to_dict(self) -> Dict[str, Any]:
         return {
             "is_safe": self.is_safe,
@@ -119,42 +171,64 @@ class SecurityScanResult:
             "high_severity_count": self.high_severity_count,
             "medium_severity_count": self.medium_severity_count,
             "low_severity_count": self.low_severity_count,
-            "requires_confirmation": self.high_severity_count > 0,
+            "requires_confirmation": self.high_severity_count > 0 and not self.has_hard_blocked,
+            "has_hard_blocked": self.has_hard_blocked,
+            "hard_blocked_count": len(self.hard_blocked_issues),
+            "sandbox_level": self.sandbox_level,
         }
-    
+
     def format_report(self) -> str:
         """Format a human-readable security report."""
         if not self.issues:
             return "✅ Security scan passed. No issues found."
-        
+
         lines = [
             f"📋 Security Scan Report (ID: {self.scan_id[:8]})",
+            f"   Sandbox Level: L{self.sandbox_level}",
             f"   Found {len(self.issues)} item(s) for review:",
             "",
         ]
-        
+
         severity_icons = {
             "Critical": "🔴",
             "High": "🟠",
             "Medium": "🟡",
             "Low": "🟢",
         }
-        
+
         for idx, issue in enumerate(self.issues, 1):
             severity = issue.get("severity", "Medium")
             icon = severity_icons.get(severity, "⚪")
-            lines.append(f"  {icon} #{idx} [{severity}] {issue.get('issue_type', 'Unknown')}")
+
+            # Mark hard blocked issues
+            is_hard_blocked = issue in self.hard_blocked_issues
+            block_marker = " 🚫 [HARD BLOCKED]" if is_hard_blocked else ""
+
+            lines.append(f"  {icon} #{idx} [{severity}] {issue.get('issue_type', 'Unknown')}{block_marker}")
             lines.append(f"     ├─ Rule: {issue.get('rule_id', 'N/A')}")
             lines.append(f"     ├─ Line {issue.get('line_number', '?')}: {issue.get('description', '')}")
             lines.append(f"     └─ Code: {issue.get('code_snippet', '')[:60]}...")
             lines.append("")
-        
-        if self.high_severity_count > 0:
+
+        # Different messages based on whether there are hard blocked issues
+        if self.has_hard_blocked:
+            lines.append("🚫 HARD BLOCKED: This code contains operations that CANNOT be executed")
+            lines.append(f"   in the current L{self.sandbox_level} sandbox environment.")
+            lines.append("")
+            lines.append("   The following operations are permanently blocked at runtime:")
+            for issue in self.hard_blocked_issues:
+                lines.append(f"   • {issue.get('issue_type', 'Unknown')}: {issue.get('description', '')}")
+            lines.append("")
+            lines.append("   ⚠️  Even with confirmation, this code will fail to execute.")
+            lines.append("   Options:")
+            lines.append("   1. Modify the code to remove blocked operations")
+            lines.append("   2. Use a lower sandbox level (L1 or L2) if permitted")
+        elif self.high_severity_count > 0:
             lines.append("⚠️  High severity issues found. Confirmation required to execute.")
             lines.append(f"   To proceed, call execute_code with confirmed=true and scan_id=\"{self.scan_id}\"")
         else:
             lines.append("ℹ️  Only low/medium severity issues found. Safe to execute.")
-        
+
         return "\n".join(lines)
 
 
@@ -235,26 +309,37 @@ This skill executes code from MCP.
         
         return skill_dir, code_file
     
-    def scan_code(self, language: str, code: str) -> SecurityScanResult:
-        """Scan code for security issues without executing it."""
+    def scan_code(self, language: str, code: str, sandbox_level: Optional[int] = None) -> SecurityScanResult:
+        """Scan code for security issues without executing it.
+
+        Args:
+            language: Programming language (python, javascript, bash)
+            code: Code to scan
+            sandbox_level: Sandbox level to check against (default: from env or 3)
+        """
+        # Use default sandbox level if not specified
+        if sandbox_level is None:
+            sandbox_level = self.default_sandbox_level
+
         if not self.runtime_available:
             return SecurityScanResult(
                 is_safe=False,
-                issues=[{"severity": "Critical", "issue_type": "RuntimeError", 
+                issues=[{"severity": "Critical", "issue_type": "RuntimeError",
                         "description": f"skillbox not found at {self.skillbox_path}",
                         "rule_id": "system", "line_number": 0, "code_snippet": ""}],
                 scan_id="error",
                 code_hash="",
                 high_severity_count=1,
+                sandbox_level=sandbox_level,
             )
-        
+
         self._cleanup_expired_scans()
         code_hash = self._generate_code_hash(language, code)
         scan_id = self._generate_scan_id(code_hash)
-        
+
         try:
             skill_dir, code_file = self._create_temp_skill(language, code)
-            
+
             try:
                 result = subprocess.run(
                     [self.skillbox_path, "security-scan", code_file],
@@ -262,12 +347,12 @@ This skill executes code from MCP.
                     text=True,
                     timeout=30
                 )
-                
+
                 issues = self._parse_scan_output(result.stdout + result.stderr)
                 high_count = sum(1 for i in issues if i.get("severity") in ["Critical", "High"])
                 medium_count = sum(1 for i in issues if i.get("severity") == "Medium")
                 low_count = sum(1 for i in issues if i.get("severity") == "Low")
-                
+
                 scan_result = SecurityScanResult(
                     is_safe=high_count == 0,
                     issues=issues,
@@ -276,14 +361,15 @@ This skill executes code from MCP.
                     high_severity_count=high_count,
                     medium_severity_count=medium_count,
                     low_severity_count=low_count,
+                    sandbox_level=sandbox_level,
                 )
-                
+
                 self._scan_cache[scan_id] = scan_result
                 return scan_result
-                
+
             finally:
                 shutil.rmtree(skill_dir, ignore_errors=True)
-                
+
         except subprocess.TimeoutExpired:
             return SecurityScanResult(
                 is_safe=False,
@@ -293,6 +379,7 @@ This skill executes code from MCP.
                 scan_id=scan_id,
                 code_hash=code_hash,
                 high_severity_count=1,
+                sandbox_level=sandbox_level,
             )
         except Exception as e:
             return SecurityScanResult(
@@ -303,6 +390,7 @@ This skill executes code from MCP.
                 scan_id=scan_id,
                 code_hash=code_hash,
                 high_severity_count=1,
+                sandbox_level=sandbox_level,
             )
     
     def _parse_scan_output(self, output: str) -> List[Dict[str, Any]]:
@@ -404,9 +492,31 @@ This skill executes code from MCP.
             }
         
         code_hash = self._generate_code_hash(language, code)
-        
+
         if sandbox_level >= 3 and not confirmed:
-            scan_result = self.scan_code(language, code)
+            scan_result = self.scan_code(language, code, sandbox_level=sandbox_level)
+
+            # Check for hard blocked issues first
+            if scan_result.has_hard_blocked:
+                return {
+                    "success": False,
+                    "stdout": "",
+                    "stderr": (
+                        f"🚫 Execution Blocked\n\n"
+                        f"{scan_result.format_report()}\n\n"
+                        f"❌ This code contains operations that are PERMANENTLY BLOCKED\n"
+                        f"   in the L{sandbox_level} sandbox environment.\n\n"
+                        f"   Even with confirmation, this code CANNOT be executed.\n\n"
+                        f"Options:\n"
+                        f"  1. Modify the code to remove blocked operations\n"
+                        f"  2. Use sandbox_level=1 or sandbox_level=2 (if permitted)\n"
+                    ),
+                    "exit_code": 4,
+                    "hard_blocked": True,
+                    "security_issues": scan_result.to_dict(),
+                }
+
+            # Soft risk: can be confirmed
             if scan_result.high_severity_count > 0:
                 return {
                     "success": False,
@@ -414,7 +524,9 @@ This skill executes code from MCP.
                     "stderr": (
                         f"🔐 Security Review Required\n\n"
                         f"{scan_result.format_report()}\n\n"
-                        f"To execute this code, call execute_code again with:\n"
+                        f"⚠️ IMPORTANT: You MUST ask the user for confirmation before proceeding.\n"
+                        f"Show this security report to the user and wait for their explicit approval.\n\n"
+                        f"If the user approves, call execute_code again with:\n"
                         f"  - confirmed: true\n"
                         f"  - scan_id: \"{scan_result.scan_id}\"\n"
                     ),
@@ -423,7 +535,7 @@ This skill executes code from MCP.
                     "scan_id": scan_result.scan_id,
                     "security_issues": scan_result.to_dict(),
                 }
-        
+
         if confirmed and scan_id:
             cached_result = self.verify_scan(scan_id, code_hash)
             if not cached_result:
@@ -436,6 +548,28 @@ This skill executes code from MCP.
                     ),
                     "exit_code": 3,
                 }
+
+            # Even with confirmation, check for hard blocked issues
+            if cached_result.has_hard_blocked:
+                return {
+                    "success": False,
+                    "stdout": "",
+                    "stderr": (
+                        f"🚫 Execution Blocked (Even After Confirmation)\n\n"
+                        f"The code contains operations that are PERMANENTLY BLOCKED\n"
+                        f"in the L{sandbox_level} sandbox environment:\n\n"
+                        + "\n".join(f"  • {issue.get('issue_type', 'Unknown')}: {issue.get('description', '')}"
+                                   for issue in cached_result.hard_blocked_issues) +
+                        f"\n\n"
+                        f"❌ Confirmation cannot override sandbox runtime restrictions.\n\n"
+                        f"Options:\n"
+                        f"  1. Modify the code to remove blocked operations\n"
+                        f"  2. Use sandbox_level=1 or sandbox_level=2 (if permitted)\n"
+                    ),
+                    "exit_code": 4,
+                    "hard_blocked": True,
+                    "security_issues": cached_result.to_dict(),
+                }
         
         try:
             skill_dir, _ = self._create_temp_skill(language, code)
@@ -494,21 +628,31 @@ This skill executes code from MCP.
 class MCPServer:
     """MCP server for SkillLite sandbox execution.
     
-    This server provides two tools for secure code execution:
-    
-    1. **scan_code**: Scan code for security issues before execution.
+    This server provides tools for skills management and secure code execution:
+
+    Skills Tools:
+    1. **list_skills**: List all available skills in the skills directory.
+    2. **get_skill_info**: Get detailed information about a specific skill.
+    3. **run_skill**: Execute a skill with given input parameters.
+
+    Code Execution Tools:
+    4. **scan_code**: Scan code for security issues before execution.
        Returns a detailed report and a scan_id for confirmation.
-    
-    2. **execute_code**: Execute code in a sandbox. If high-severity
+    5. **execute_code**: Execute code in a sandbox. If high-severity
        security issues are found, requires explicit confirmation.
-    
-    Example workflow:
+
+    Example workflow for skills:
+        1. Call list_skills to see available skills
+        2. Call get_skill_info to understand a skill's parameters
+        3. Call run_skill with the required input
+
+    Example workflow for code execution:
         1. Call scan_code to check for security issues
         2. Review the security report with the user
         3. If user approves, call execute_code with confirmed=true and scan_id
     """
-    
-    def __init__(self):
+
+    def __init__(self, skills_dir: Optional[str] = None):
         if not MCP_AVAILABLE:
             raise ImportError(
                 "MCP library not available. Please install it with: "
@@ -516,14 +660,98 @@ class MCPServer:
             )
         self.server = Server("skilllite-mcp-server")
         self.executor = SandboxExecutor()
+
+        # Initialize SkillManager for skills support
+        self.skills_dir = skills_dir or os.environ.get("SKILLLITE_SKILLS_DIR", "./.skills")
+        self.skill_manager = None
+        self._init_skill_manager()
+
         self._setup_handlers()
+
+    def _init_skill_manager(self):
+        """Initialize the SkillManager if skills directory exists."""
+        try:
+            from ..core.manager import SkillManager
+            skills_path = Path(self.skills_dir)
+            if skills_path.exists():
+                self.skill_manager = SkillManager(skills_dir=str(skills_path))
+        except Exception as e:
+            # Skills not available, continue without them
+            pass
     
     def _setup_handlers(self):
         """Setup MCP server handlers."""
-        
+
         @self.server.list_tools()
         async def list_tools() -> List[Tool]:
-            return [
+            tools = [
+                # Skills management tools
+                Tool(
+                    name="list_skills",
+                    description=(
+                        "List all available skills in the skills directory. "
+                        "Returns skill names, descriptions, and languages."
+                    ),
+                    inputSchema={
+                        "type": "object",
+                        "properties": {},
+                        "required": []
+                    }
+                ),
+                Tool(
+                    name="get_skill_info",
+                    description=(
+                        "Get detailed information about a specific skill, "
+                        "including its input schema, description, and usage."
+                    ),
+                    inputSchema={
+                        "type": "object",
+                        "properties": {
+                            "skill_name": {
+                                "type": "string",
+                                "description": "Name of the skill to get info for"
+                            }
+                        },
+                        "required": ["skill_name"]
+                    }
+                ),
+                Tool(
+                    name="run_skill",
+                    description=(
+                        "Execute a skill with the given input parameters. "
+                        "Use list_skills to see available skills and "
+                        "get_skill_info to understand required parameters. "
+                        "IMPORTANT: If the skill has high-severity security issues, "
+                        "you MUST show the security report to the user and ASK for their explicit confirmation "
+                        "before setting confirmed=true. Do NOT auto-confirm without user approval."
+                    ),
+                    inputSchema={
+                        "type": "object",
+                        "properties": {
+                            "skill_name": {
+                                "type": "string",
+                                "description": "Name of the skill to execute"
+                            },
+                            "input": {
+                                "type": "object",
+                                "description": "Input parameters for the skill"
+                            },
+                            "confirmed": {
+                                "type": "boolean",
+                                "description": (
+                                    "Set to true ONLY after the user has explicitly approved execution. "
+                                    "You must ask the user for confirmation first."
+                                )
+                            },
+                            "scan_id": {
+                                "type": "string",
+                                "description": "Scan ID from security review (required when confirmed=true)"
+                            }
+                        },
+                        "required": ["skill_name"]
+                    }
+                ),
+                # Code execution tools
                 Tool(
                     name="scan_code",
                     description=(
@@ -551,8 +779,9 @@ class MCPServer:
                     name="execute_code",
                     description=(
                         "Execute code in a secure sandbox environment. "
-                        "If security issues are found, you must set confirmed=true "
-                        "and provide the scan_id from a previous scan_code call."
+                        "IMPORTANT: If security issues are found, you MUST show the security report "
+                        "to the user and ASK for their explicit confirmation before setting confirmed=true. "
+                        "Do NOT auto-confirm without user approval."
                     ),
                     inputSchema={
                         "type": "object",
@@ -569,8 +798,8 @@ class MCPServer:
                             "confirmed": {
                                 "type": "boolean",
                                 "description": (
-                                    "Set to true to confirm execution despite security warnings. "
-                                    "Required when high-severity issues are found."
+                                    "Set to true ONLY after the user has explicitly approved execution. "
+                                    "You must ask the user for confirmation first."
                                 ),
                                 "default": False
                             },
@@ -595,13 +824,22 @@ class MCPServer:
                     }
                 )
             ]
+            return tools
         
         @self.server.call_tool()
         async def call_tool(
             name: str,
             arguments: Dict[str, Any]
         ) -> "CallToolResult":
-            if name == "scan_code":
+            # Skills management tools
+            if name == "list_skills":
+                return await self._handle_list_skills(arguments)
+            elif name == "get_skill_info":
+                return await self._handle_get_skill_info(arguments)
+            elif name == "run_skill":
+                return await self._handle_run_skill(arguments)
+            # Code execution tools
+            elif name == "scan_code":
                 return await self._handle_scan_code(arguments)
             elif name == "execute_code":
                 return await self._handle_execute_code(arguments)
@@ -675,6 +913,18 @@ class MCPServer:
             sandbox_level=sandbox_level,
         )
         
+        # Handle hard blocked case - this is a definitive block, not a confirmation request
+        if result.get("hard_blocked"):
+            return CallToolResult(
+                isError=True,
+                content=[
+                    TextContent(
+                        type="text",
+                        text=result["stderr"]
+                    )
+                ]
+            )
+
         if result.get("requires_confirmation"):
             return CallToolResult(
                 content=[
@@ -684,15 +934,15 @@ class MCPServer:
                     )
                 ]
             )
-        
+
         output_lines = []
         if result["stdout"]:
             output_lines.append(f"Output:\n{result['stdout']}")
         if result["stderr"]:
             output_lines.append(f"Errors:\n{result['stderr']}")
-        
+
         output_text = "\n".join(output_lines) if output_lines else "Execution completed successfully (no output)"
-        
+
         if result["success"]:
             return CallToolResult(
                 content=[
@@ -712,7 +962,245 @@ class MCPServer:
                     )
                 ]
             )
-    
+
+    async def _handle_list_skills(self, arguments: Dict[str, Any]) -> "CallToolResult":
+        """Handle list_skills tool call."""
+        if not self.skill_manager:
+            return CallToolResult(
+                content=[
+                    TextContent(
+                        type="text",
+                        text=f"No skills available. Skills directory not found: {self.skills_dir}"
+                    )
+                ]
+            )
+
+        skills = self.skill_manager.list_skills()
+        if not skills:
+            return CallToolResult(
+                content=[
+                    TextContent(
+                        type="text",
+                        text=f"No skills found in directory: {self.skills_dir}"
+                    )
+                ]
+            )
+
+        # Format skills list
+        lines = ["Available Skills:", ""]
+        for skill in skills:
+            lines.append(f"• **{skill.name}**")
+            if skill.description:
+                lines.append(f"  {skill.description}")
+            if skill.language:
+                lines.append(f"  Language: {skill.language}")
+            lines.append("")
+
+        return CallToolResult(
+            content=[
+                TextContent(
+                    type="text",
+                    text="\n".join(lines)
+                )
+            ]
+        )
+
+    async def _handle_get_skill_info(self, arguments: Dict[str, Any]) -> "CallToolResult":
+        """Handle get_skill_info tool call."""
+        skill_name = arguments.get("skill_name")
+
+        if not skill_name:
+            return CallToolResult(
+                isError=True,
+                content=[
+                    TextContent(
+                        type="text",
+                        text="Missing required argument: skill_name"
+                    )
+                ]
+            )
+
+        if not self.skill_manager:
+            return CallToolResult(
+                isError=True,
+                content=[
+                    TextContent(
+                        type="text",
+                        text=f"No skills available. Skills directory not found: {self.skills_dir}"
+                    )
+                ]
+            )
+
+        skill = self.skill_manager.get_skill(skill_name)
+        if not skill:
+            available = ", ".join(self.skill_manager.skill_names()) or "none"
+            return CallToolResult(
+                isError=True,
+                content=[
+                    TextContent(
+                        type="text",
+                        text=f"Skill not found: {skill_name}\nAvailable skills: {available}"
+                    )
+                ]
+            )
+
+        # Format skill info
+        lines = [f"# {skill.name}", ""]
+        if skill.description:
+            lines.append(skill.description)
+            lines.append("")
+
+        lines.append("## Details")
+        lines.append(f"- **Language**: {skill.language or 'unknown'}")
+        lines.append(f"- **Path**: {skill.path}")
+        if skill.entry_point:
+            lines.append(f"- **Entry Point**: {skill.entry_point}")
+
+        # Add input schema if available
+        if skill.input_schema:
+            lines.append("")
+            lines.append("## Input Schema")
+            lines.append("```json")
+            lines.append(json.dumps(skill.input_schema, indent=2))
+            lines.append("```")
+
+        return CallToolResult(
+            content=[
+                TextContent(
+                    type="text",
+                    text="\n".join(lines)
+                )
+            ]
+        )
+
+    async def _handle_run_skill(self, arguments: Dict[str, Any]) -> "CallToolResult":
+        """
+        Handle run_skill tool call using UnifiedExecutionService.
+
+        This method uses the unified execution layer which:
+        1. Reads sandbox level at runtime
+        2. Handles security scanning
+        3. Properly downgrades sandbox level after confirmation
+        """
+        skill_name = arguments.get("skill_name")
+        input_data = arguments.get("input", {})
+        confirmed = arguments.get("confirmed", False)
+        scan_id = arguments.get("scan_id")
+
+        if not skill_name:
+            return CallToolResult(
+                isError=True,
+                content=[
+                    TextContent(
+                        type="text",
+                        text="Missing required argument: skill_name"
+                    )
+                ]
+            )
+
+        if not self.skill_manager:
+            return CallToolResult(
+                isError=True,
+                content=[
+                    TextContent(
+                        type="text",
+                        text=f"No skills available. Skills directory not found: {self.skills_dir}"
+                    )
+                ]
+            )
+
+        if not self.skill_manager.has_skill(skill_name):
+            available = ", ".join(self.skill_manager.skill_names()) or "none"
+            return CallToolResult(
+                isError=True,
+                content=[
+                    TextContent(
+                        type="text",
+                        text=f"Skill not found: {skill_name}\nAvailable skills: {available}"
+                    )
+                ]
+            )
+
+        # Get skill info
+        skill = self.skill_manager.get_skill(skill_name)
+        if not skill:
+            return CallToolResult(
+                isError=True,
+                content=[
+                    TextContent(
+                        type="text",
+                        text=f"Could not load skill: {skill_name}"
+                    )
+                ]
+            )
+
+        # Use UnifiedExecutionService
+        from ..sandbox.execution_service import UnifiedExecutionService
+        from ..sandbox.context import ExecutionContext
+
+        service = UnifiedExecutionService.get_instance()
+
+        # MCP uses async confirmation pattern (return report -> client calls back with confirmed=True)
+        # Create a "callback" that captures the scan result for MCP's async flow
+        scan_result_holder = {"result": None}
+
+        def mcp_confirmation_callback(report: str, scan_id_from_scan: str) -> bool:
+            # If client already confirmed, return True
+            if confirmed:
+                return True
+            # Otherwise, store the result and return False to abort execution
+            # MCP will then return the report to the client
+            scan_result_holder["result"] = {"report": report, "scan_id": scan_id_from_scan}
+            return False
+
+        # Execute using unified service
+        result = service.execute_skill(
+            skill_info=skill,
+            input_data=input_data,
+            confirmation_callback=mcp_confirmation_callback if not confirmed else lambda r, s: True,
+        )
+
+        # Check if we need to return a security report (MCP async confirmation pattern)
+        if scan_result_holder["result"] is not None:
+            report_data = scan_result_holder["result"]
+            return CallToolResult(
+                content=[
+                    TextContent(
+                        type="text",
+                        text=(
+                            f"🔐 Security Review Required for skill '{skill_name}'\n\n"
+                            f"{report_data['report']}\n\n"
+                            f"⚠️ IMPORTANT: You MUST ask the user for confirmation before proceeding.\n"
+                            f"Show this security report to the user and wait for their explicit approval.\n\n"
+                            f"If the user approves, call run_skill again with:\n"
+                            f"  - confirmed: true\n"
+                            f"  - scan_id: \"{report_data['scan_id']}\"\n"
+                        )
+                    )
+                ]
+            )
+
+        # Return execution result
+        if result.success:
+            return CallToolResult(
+                content=[
+                    TextContent(
+                        type="text",
+                        text=f"Skill '{skill_name}' executed successfully.\n\nOutput:\n{result.output}"
+                    )
+                ]
+            )
+        else:
+            return CallToolResult(
+                isError=True,
+                content=[
+                    TextContent(
+                        type="text",
+                        text=f"Skill '{skill_name}' execution failed.\n\nError:\n{result.error}"
+                    )
+                ]
+            )
+
     async def run(self):
         """Run the MCP server."""
         async with stdio_server() as (read_stream, write_stream):