Skills

[skills] decides which of the discovered Agent Skills the model may see.

[skills]
disabled = ["slow-review", "legacy-deploy"]
project = true

Disabling a skill

A disabled skill is still discovered, so /skills lists it, marked [disabled], and a misspelled name is caught. It is left out of the catalog in the system prompt and out of the skill tool, and /skill NAME and the tool both refuse it by name, saying which file disabled it:

skill "slow-review" is disabled by [skills] disabled in the project config

A name that matches no discovered skill is not an error. /skills lists it under "Disabled but not found", so a list in your user file can name skills that only some projects have.

A skill that was already active when you disabled it stays in the conversation: history is not rewritten. /skills shows it as active and disabled. Disabling stops future activations only; /new starts a conversation without it.

Refusing a project's skills

A project's skills are project instructions, trusted as AGENTS.md is, and heph loads them from any repository it starts in. To keep every project's skill directories out of discovery, set this in your user file:

[skills]
project = false

Your own skill directories are still read. Only the user file may set project: in .heph/config.toml it is an error at startup that says so, since a project deciding whether its own skills are trusted would mean nothing.

How the two files merge

The disabled lists concatenate, yours first, as [permissions] deny does. A project can disable more skills than you do, never fewer.

/skills --reload rereads this table from both files, with the same rules, so a change here takes effect without a restart.