fix(skills): reject Windows device names

src/shared/skill-package-manifest.test.ts

@@ -37,6 +37,15 @@ describe('skill package manifest', () => {
     expect(parseSkillPackageManifest(manifest()).name).toBe('test-skill')
   })
 
+  it.each(['con', 'prn', 'aux', 'nul', 'com1', 'com9', 'lpt1', 'lpt9'])(
+    'rejects the Windows device skill name %s',
+    (name) => {
+      expect(() => parseSkillPackageManifest({ ...(manifest() as object), name })).toThrow(
+        'skill-package-skill-name-invalid'
+      )
+    }
+  )
+
   it.each([
     '../SKILL.md',
     '/SKILL.md',

src/shared/skill-package-manifest.ts

@@ -44,7 +44,7 @@ export const SkillPackageManifestV1Schema = z
 export type SkillPackageManifestV1 = z.infer<typeof SkillPackageManifestV1Schema>
 
 export function validateSkillPackageName(name: string): void {
-  if (!SKILL_NAME_PATTERN.test(name)) {
+  if (!SKILL_NAME_PATTERN.test(name) || WINDOWS_RESERVED_SEGMENT.test(name)) {
     throw new Error('skill-package-skill-name-invalid')
   }
 }
@@ -96,6 +96,7 @@ export function parseSkillPackageManifest(value: unknown): SkillPackageManifestV
   if (!parsed.success) {
     throw new Error('skill-package-manifest-invalid')
   }
+  validateSkillPackageName(parsed.data.name)
   let previousPath: string | null = null
   const foldedPaths = new Set<string>()
   let totalBytes = 0