fix(security): close API token agent authorization gaps

routes/skills_routes.py

@@ -13,11 +13,11 @@ from typing import List, Optional
 
 import httpx
 
-from fastapi import APIRouter, HTTPException, Request
+from fastapi import APIRouter, Depends, HTTPException, Request
 from pydantic import BaseModel, Field
 
 from services.memory.skills import SkillsManager
-from src.auth_helpers import get_current_user
+from src.auth_helpers import require_interactive_request
 from src.prompt_security import untrusted_context_message
 from core.middleware import require_admin
 
@@ -1181,10 +1181,14 @@ async def run_scheduled_skill_audit(skills_manager: SkillsManager,
 
 
 def setup_skills_routes(skills_manager: SkillsManager) -> APIRouter:
-    router = APIRouter(prefix="/api/skills", tags=["skills"])
+    router = APIRouter(
+        prefix="/api/skills",
+        tags=["skills"],
+        dependencies=[Depends(require_interactive_request)],
+    )
 
     def _owner(request: Request) -> Optional[str]:
-        return get_current_user(request)
+        return require_interactive_request(request)
 
     def _verify_owner(skill: dict, user: Optional[str]):
         if user is None: