Tencent/WeKnora · error

skill not allowed: %s

Error message

skill not allowed: %s

What it means

Authorization guard in Manager.LoadSkill: isSkillAllowed(skillName) returned false, so the requested skill exists/loads but is not in the allow-list (tenant or deployment policy). It is a policy rejection, deliberately distinct from "not found".

Source

Thrown at internal/agent/skills/manager.go:264

	m.mu.RLock()
	defer m.mu.RUnlock()

	// Return a copy to prevent external modification
	result := make([]*SkillMetadata, len(m.metadataCache))
	copy(result, m.metadataCache)
	return result
}

// LoadSkill loads the full instructions of a skill (Level 2)
func (m *Manager) LoadSkill(ctx context.Context, skillName string) (*Skill, error) {
	if !m.enabled {
		return nil, fmt.Errorf("skills are not enabled")
	}

	// Check if skill is allowed
	if !m.isSkillAllowed(skillName) {
		return nil, fmt.Errorf("skill not allowed: %s", skillName)
	}

	return m.resolveSource(skillName).LoadSkillInstructions(skillName)
}

// isSkillAllowed checks if a skill is in the allowed list
func (m *Manager) isSkillAllowed(skillName string) bool {
	if len(m.allowedSkills) == 0 {
		return true
	}
	for _, name := range m.allowedSkills {
		if name == skillName {
			return true
		}
	}
	return false
}

View on GitHub (pinned to 988cbb0330)

Solutions

1. Add the skill to the tenant/deployment allow-list if access is intended
2. Verify the exact skill name matches the allowed entry (case and spelling)
3. Surface a user-facing permission error rather than retrying

When it happens

Trigger: Thrown at internal/agent/skills/manager.go:264 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/e24a784efbcba981. Report an issue: GitHub.