Agent Plugin Skills cannot enforce parent tool restrictions during setup #138

Summary

Agent Plugin Skills currently cannot enforce a tool restriction on the parent MiniMax Code session while performing plugin-guided setup. This prevents certifying autonomous, native-only setup flows for security-sensitive plugins.

Environment

• MiniMax Code: 3.0.68.134
• Plugin type: Agent Plugin, imported from a public Git repository
• Setup initiated from a selected Plugin Skill in a disposable MiniMax profile

Reproduction

1. Create or import an Agent Plugin with a Skill that guides a setup operation through MiniMax-native mechanisms (for example, mavis agent profile/configuration operations).
2. In the Skill prompt, explicitly provide all required input (including the temporary profile root) and explicitly prohibit Terminal, shell commands, HTTP requests, direct store edits, and direct agent workflow/system-prompt/project-file changes.
3. Start the Skill from the MiniMax Code desktop UI.
4. The Skill can invoke its MCP helper, but the parent session still has Terminal available and may invoke it (observed: a directory listing command) to inspect the plugin or profile before continuing.

Actual behavior

The parent agent's available tools are not constrained by the selected Skill's instructions. Prompt-level restrictions are advisory only: Terminal remains exposed and can be used during setup.

Custom Agent agent.md tool selectors can restrict child roles, but they do not restrict the parent session executing the Plugin Skill. Therefore they cannot provide an end-to-end guarantee for a native-only, shell-free setup flow.

Expected behavior

Please provide one of these host-enforced mechanisms:

1. A declarative allowlist/denylist for tools available to the parent session while a Plugin Skill is running (for example, excluding Terminal and shell); or
2. A non-prompt native setup API/surface for Agent Plugins to create/update supported agent configuration safely, without asking the parent model to perform file or shell operations.

The restriction must be enforced by the host, visible to the user, and testable by plugin authors.

Impact

Without a host-enforced boundary, a plugin cannot truthfully certify autonomous setup as native-only or shell-free. For production distribution, the only safe outcomes are a supervised manual setup contract or a fail-closed block. This affects plugins that need to install or configure multi-agent roles while preserving least privilege.

Could you confirm whether a parent-session tool policy already exists (and how Plugin Skills declare it), or whether this capability/API is planned?