hermes - 💡(How to fix) Fix [Bug]: `_create_skill` / `_edit_skill` allow frontmatter `name` to diverge from directory name

Summary

skill_manage(action="create", name="foo", content="---\nname: bar\n...") silently creates a skill whose directory is foo/ but whose skills_list display name is bar. The write path never validates that frontmatter name matches the name parameter.

Reproduction

skill_manage(
    action="create",
    name="local-paper-summarizer",
    content="---\nname: local-paper-summary\ndescription: ...\n---\n\nSteps..."
)

• skills_list() shows local-paper-summary (frontmatter name, skills_tool.py:585)
• skill_view("local-paper-summary") → not found (directory-name lookup, skills_tool.py:969)
• skill_manage(action="edit", name="local-paper-summarizer") → found (directory-name lookup, skill_manager_tool.py:289)

Same divergence can be introduced via edit or patch.

Why this is different from #17914 / #18872 / #5433 / #7669

Those issues patch read-path symptoms (skill_view can't resolve frontmatter name, bundled skill misclassified, etc.). This is the write-path root cause — _create_skill and _edit_skill allow inconsistent data to enter the system. Fixing read paths is necessary but insufficient: as long as the write path permits divergence, every new read-path consumer must independently handle the dual-namespace problem.

Root cause

• _validate_frontmatter() (skill_manager_tool.py:240) only checks that a name field exists — no cross-check against the directory name
• _create_skill() (skill_manager_tool.py:403) writes content verbatim
• _edit_skill() (skill_manager_tool.py:446) same
• _patch_skill() (skill_manager_tool.py:537) calls _validate_frontmatter without cross-check
• Hub installs are unaffected (both names derive from the same SKILL.md)

Proposed fix

Add expected_name to _validate_frontmatter and wire it through _create_skill, _edit_skill, and _patch_skill:

def _validate_frontmatter(content: str, expected_name: str = None) -> Optional[str]:
    ...
    if expected_name and str(parsed["name"]) != expected_name:
        return (
            f"Frontmatter name '{parsed['name']}' does not match skill name "
            f"'{expected_name}'. The frontmatter name must match the 'name' parameter."
        )

Explicit rejection over silent auto-overwrite — the error message lets the agent self-correct.

Missing test coverage

tests/tools/test_skill_manager_tool.py:137 only covers "frontmatter name missing". Should add:

• create with frontmatter name ≠ name param → fail
• edit changing frontmatter name away from directory name → fail
• patch altering name: to diverge from directory name → fail
• create with frontmatter name == name param → succeed

Related

• #17914 / #18872 — read-path: skill_view vs skills_list name mismatch
• #5433 — read-path: bundled manifest vs frontmatter name causes misclassification
• #7669 — read-path: _get_skill_type() vs _scan_skill_names() name mismatch