skills: remove unused skill permission metadata (#15900)

## Why

Skill metadata accepted a `permissions` block and stored the result on
`SkillMetadata`, but that data was never consumed by runtime behavior.
Leaving the dead parsing path in place makes it look like skills can
widen or otherwise influence execution permissions when, in practice,
declared skill permissions are ignored.

This change removes that misleading surface area so the skill metadata
model matches what the system actually uses.

## What changed

- removed `permission_profile` and `managed_network_override` from
`core-skills::SkillMetadata`
- stopped parsing `permissions` from skill metadata in
`core-skills/src/loader.rs`
- deleted the loader tests that only exercised the removed permissions
parsing path
- cleaned up dependent `SkillMetadata` constructors in tests and TUI
code that were only carrying `None` for those fields

## Testing

- `cargo test -p codex-core-skills`
- `cargo test -p codex-tui
submission_prefers_selected_duplicate_skill_path`
- `just argument-comment-lint`

codex-rs/core-skills/src/injection_tests.rs

@@ -11,8 +11,6 @@ fn make_skill(name: &str, path: &str) -> SkillMetadata {
         interface: None,
         dependencies: None,
         policy: None,
-        permission_profile: None,
-        managed_network_override: None,
         path_to_skills_md: PathBuf::from(path),
         scope: codex_protocol::protocol::SkillScope::User,
     }

codex-rs/core-skills/src/invocation_utils_tests.rs

@@ -18,8 +18,6 @@ fn test_skill_metadata(skill_doc_path: PathBuf) -> SkillMetadata {
         interface: None,
         dependencies: None,
         policy: None,
-        permission_profile: None,
-        managed_network_override: None,
         path_to_skills_md: skill_doc_path,
         scope: codex_protocol::protocol::SkillScope::User,
     }

codex-rs/core-skills/src/loader.rs

@@ -2,7 +2,6 @@ use crate::model::SkillDependencies;
 use crate::model::SkillError;
 use crate::model::SkillInterface;
 use crate::model::SkillLoadOutcome;
-use crate::model::SkillManagedNetworkOverride;
 use crate::model::SkillMetadata;
 use crate::model::SkillPolicy;
 use crate::model::SkillToolDependency;
@@ -13,10 +12,6 @@ use codex_config::ConfigLayerStackOrdering;
 use codex_config::default_project_root_markers;
 use codex_config::merge_toml_values;
 use codex_config::project_root_markers_from_config;
-use codex_protocol::models::FileSystemPermissions;
-use codex_protocol::models::MacOsSeatbeltProfileExtensions;
-use codex_protocol::models::NetworkPermissions;
-use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::Product;
 use codex_protocol::protocol::SkillScope;
 use codex_utils_absolute_path::AbsolutePathBufGuard;
@@ -59,8 +54,6 @@ struct SkillMetadataFile {
     dependencies: Option<Dependencies>,
     #[serde(default)]
     policy: Option<Policy>,
-    #[serde(default)]
-    permissions: Option<SkillPermissionProfile>,
 }
 
 #[derive(Default)]
@@ -68,28 +61,6 @@ struct LoadedSkillMetadata {
     interface: Option<SkillInterface>,
     dependencies: Option<SkillDependencies>,
     policy: Option<SkillPolicy>,
-    permission_profile: Option<PermissionProfile>,
-    managed_network_override: Option<SkillManagedNetworkOverride>,
-}
-
-#[derive(Debug, Default, Deserialize, PartialEq, Eq)]
-struct SkillPermissionProfile {
-    #[serde(default)]
-    network: Option<SkillNetworkPermissions>,
-    #[serde(default)]
-    file_system: Option<FileSystemPermissions>,
-    #[serde(default)]
-    macos: Option<MacOsSeatbeltProfileExtensions>,
-}
-
-#[derive(Debug, Default, Deserialize, PartialEq, Eq)]
-struct SkillNetworkPermissions {
-    #[serde(default)]
-    enabled: Option<bool>,
-    #[serde(default)]
-    allowed_domains: Option<Vec<String>>,
-    #[serde(default)]
-    denied_domains: Option<Vec<String>>,
 }
 
 #[derive(Debug, Default, Deserialize)]
@@ -551,8 +522,6 @@ fn parse_skill_file(path: &Path, scope: SkillScope) -> Result<SkillMetadata, Ski
         interface,
         dependencies,
         policy,
-        permission_profile,
-        managed_network_override,
     } = load_skill_metadata(path);
 
     validate_len(&name, MAX_NAME_LEN, "name")?;
@@ -574,8 +543,6 @@ fn parse_skill_file(path: &Path, scope: SkillScope) -> Result<SkillMetadata, Ski
         interface,
         dependencies,
         policy,
-        permission_profile,
-        managed_network_override,
         path_to_skills_md: resolved_path,
         scope,
     })
@@ -639,54 +606,14 @@ fn load_skill_metadata(skill_path: &Path) -> LoadedSkillMetadata {
         interface,
         dependencies,
         policy,
-        permissions,
     } = parsed;
-    let (permission_profile, managed_network_override) = normalize_permissions(permissions);
     LoadedSkillMetadata {
         interface: resolve_interface(interface, skill_dir),
         dependencies: resolve_dependencies(dependencies),
         policy: resolve_policy(policy),
-        permission_profile,
-        managed_network_override,
     }
 }
 
-fn normalize_permissions(
-    permissions: Option<SkillPermissionProfile>,
-) -> (
-    Option<PermissionProfile>,
-    Option<SkillManagedNetworkOverride>,
-) {
-    let Some(permissions) = permissions else {
-        return (None, None);
-    };
-    let managed_network_override = permissions
-        .network
-        .as_ref()
-        .map(|network| SkillManagedNetworkOverride {
-            allowed_domains: network.allowed_domains.clone(),
-            denied_domains: network.denied_domains.clone(),
-        })
-        .filter(SkillManagedNetworkOverride::has_domain_overrides);
-    let permission_profile = PermissionProfile {
-        network: permissions.network.and_then(|network| {
-            let network = NetworkPermissions {
-                enabled: network.enabled,
-            };
-            (!network.is_empty()).then_some(network)
-        }),
-        file_system: permissions
-            .file_system
-            .filter(|file_system| !file_system.is_empty()),
-        macos: permissions.macos,
-    };
-
-    (
-        (!permission_profile.is_empty()).then_some(permission_profile),
-        managed_network_override,
-    )
-}
-
 fn resolve_interface(interface: Option<Interface>, skill_dir: &Path) -> Option<SkillInterface> {
     let interface = interface?;
     let interface = SkillInterface {

codex-rs/core-skills/src/loader_tests.rs

@@ -4,12 +4,6 @@ use codex_config::ConfigLayerEntry;
 use codex_config::ConfigLayerStack;
 use codex_config::ConfigRequirements;
 use codex_config::ConfigRequirementsToml;
-use codex_protocol::models::FileSystemPermissions;
-use codex_protocol::models::MacOsAutomationPermission;
-use codex_protocol::models::MacOsContactsPermission;
-use codex_protocol::models::MacOsPreferencesPermission;
-use codex_protocol::models::MacOsSeatbeltProfileExtensions;
-use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::Product;
 use codex_protocol::protocol::SkillScope;
 use codex_utils_absolute_path::AbsolutePathBuf;
@@ -290,8 +284,6 @@ fn loads_skills_from_home_agents_dir_for_user_scope() -> anyhow::Result<()> {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -442,8 +434,6 @@ async fn loads_skill_dependencies_metadata_from_yaml() {
                 ],
             }),
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -499,8 +489,6 @@ interface:
             }),
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(skill_path.as_path()),
             scope: SkillScope::User,
         }]
@@ -610,340 +598,6 @@ policy:
     );
 }
 
-#[tokio::test]
-async fn loads_skill_permissions_from_yaml() {
-    let codex_home = tempfile::tempdir().expect("tempdir");
-    let skill_path = write_skill(&codex_home, "demo", "permissions-skill", "from yaml");
-    let skill_dir = skill_path.parent().expect("skill dir");
-    fs::create_dir_all(skill_dir.join("data")).expect("create read path");
-    fs::create_dir_all(skill_dir.join("output")).expect("create write path");
-
-    write_skill_metadata_at(
-        skill_dir,
-        r#"
-permissions:
-  network:
-    enabled: true
-  file_system:
-    read:
-      - "./data"
-    write:
-      - "./output"
-"#,
-    );
-
-    let cfg = make_config(&codex_home).await;
-    let outcome = load_skills_for_test(&cfg);
-
-    assert!(
-        outcome.errors.is_empty(),
-        "unexpected errors: {:?}",
-        outcome.errors
-    );
-    assert_eq!(outcome.skills.len(), 1);
-    assert_eq!(
-        outcome.skills[0].permission_profile,
-        Some(PermissionProfile {
-            network: Some(NetworkPermissions {
-                enabled: Some(true),
-            }),
-            file_system: Some(FileSystemPermissions {
-                read: Some(vec![
-                    AbsolutePathBuf::try_from(normalized(skill_dir.join("data").as_path()))
-                        .expect("absolute data path"),
-                ]),
-                write: Some(vec![
-                    AbsolutePathBuf::try_from(normalized(skill_dir.join("output").as_path()))
-                        .expect("absolute output path"),
-                ]),
-            }),
-            macos: None,
-        })
-    );
-    assert_eq!(outcome.skills[0].managed_network_override, None);
-}
-
-#[tokio::test]
-async fn empty_skill_permissions_do_not_create_profile() {
-    let codex_home = tempfile::tempdir().expect("tempdir");
-    let skill_path = write_skill(&codex_home, "demo", "permissions-empty", "from yaml");
-    let skill_dir = skill_path.parent().expect("skill dir");
-
-    write_skill_metadata_at(
-        skill_dir,
-        r#"
-permissions: {}
-"#,
-    );
-
-    let cfg = make_config(&codex_home).await;
-    let outcome = load_skills_for_test(&cfg);
-
-    assert!(
-        outcome.errors.is_empty(),
-        "unexpected errors: {:?}",
-        outcome.errors
-    );
-    assert_eq!(outcome.skills.len(), 1);
-    assert_eq!(outcome.skills[0].permission_profile, None);
-}
-
-#[test]
-fn normalize_permissions_splits_managed_network_overrides() {
-    let (permission_profile, managed_network_override) =
-        normalize_permissions(Some(SkillPermissionProfile {
-            network: Some(SkillNetworkPermissions {
-                enabled: Some(true),
-                allowed_domains: Some(vec!["skill.example.com".to_string()]),
-                denied_domains: Some(vec!["blocked.skill.example.com".to_string()]),
-            }),
-            file_system: None,
-            macos: None,
-        }));
-
-    assert_eq!(
-        permission_profile,
-        Some(PermissionProfile {
-            network: Some(NetworkPermissions {
-                enabled: Some(true),
-            }),
-            file_system: None,
-            macos: None,
-        })
-    );
-    assert_eq!(
-        managed_network_override,
-        Some(SkillManagedNetworkOverride {
-            allowed_domains: Some(vec!["skill.example.com".to_string()]),
-            denied_domains: Some(vec!["blocked.skill.example.com".to_string()]),
-        })
-    );
-}
-
-#[test]
-fn normalize_permissions_preserves_network_gate_separately_from_overrides() {
-    let (permission_profile, managed_network_override) =
-        normalize_permissions(Some(SkillPermissionProfile {
-            network: Some(SkillNetworkPermissions {
-                enabled: Some(false),
-                allowed_domains: Some(vec!["skill.example.com".to_string()]),
-                denied_domains: None,
-            }),
-            file_system: None,
-            macos: None,
-        }));
-
-    assert_eq!(
-        permission_profile,
-        Some(PermissionProfile {
-            network: Some(NetworkPermissions {
-                enabled: Some(false),
-            }),
-            file_system: None,
-            macos: None,
-        })
-    );
-    assert_eq!(
-        managed_network_override,
-        Some(SkillManagedNetworkOverride {
-            allowed_domains: Some(vec!["skill.example.com".to_string()]),
-            denied_domains: None,
-        })
-    );
-}
-
-#[test]
-fn skill_metadata_parses_macos_permissions_yaml() {
-    let parsed = serde_yaml::from_str::<SkillMetadataFile>(
-        r#"
-permissions:
-  macos:
-    macos_preferences: "read_write"
-    macos_automation:
-      - "com.apple.Notes"
-    macos_launch_services: true
-    macos_accessibility: true
-    macos_calendar: true
-"#,
-    )
-    .expect("parse skill metadata");
-
-    assert_eq!(
-        parsed.permissions,
-        Some(SkillPermissionProfile {
-            network: None,
-            file_system: None,
-            macos: Some(MacOsSeatbeltProfileExtensions {
-                macos_preferences: MacOsPreferencesPermission::ReadWrite,
-                macos_automation: MacOsAutomationPermission::BundleIds(vec![
-                    "com.apple.Notes".to_string(),
-                ]),
-                macos_launch_services: true,
-                macos_accessibility: true,
-                macos_calendar: true,
-                macos_reminders: false,
-                macos_contacts: MacOsContactsPermission::None,
-            }),
-        })
-    );
-}
-
-#[test]
-fn skill_metadata_parses_macos_reminders_permission_yaml() {
-    let parsed = serde_yaml::from_str::<SkillMetadataFile>(
-        r#"
-permissions:
-  macos:
-    macos_reminders: true
-"#,
-    )
-    .expect("parse reminders skill metadata");
-
-    assert_eq!(
-        parsed.permissions,
-        Some(SkillPermissionProfile {
-            network: None,
-            file_system: None,
-            macos: Some(MacOsSeatbeltProfileExtensions {
-                macos_preferences: MacOsPreferencesPermission::ReadOnly,
-                macos_automation: MacOsAutomationPermission::None,
-                macos_launch_services: false,
-                macos_accessibility: false,
-                macos_calendar: false,
-                macos_reminders: true,
-                macos_contacts: MacOsContactsPermission::None,
-            }),
-        })
-    );
-}
-
-#[test]
-fn skill_metadata_parses_network_domain_overrides_under_permissions() {
-    let parsed = serde_yaml::from_str::<SkillMetadataFile>(
-        r#"
-permissions:
-  network:
-    enabled: true
-    allowed_domains:
-      - "skill.example.com"
-    denied_domains:
-      - "blocked.skill.example.com"
-"#,
-    )
-    .expect("parse network skill metadata");
-
-    assert_eq!(
-        parsed.permissions,
-        Some(SkillPermissionProfile {
-            network: Some(SkillNetworkPermissions {
-                enabled: Some(true),
-                allowed_domains: Some(vec!["skill.example.com".to_string()]),
-                denied_domains: Some(vec!["blocked.skill.example.com".to_string()]),
-            }),
-            file_system: None,
-            macos: None,
-        })
-    );
-}
-
-#[cfg(target_os = "macos")]
-#[tokio::test]
-async fn loads_skill_macos_permissions_from_yaml() {
-    let codex_home = tempfile::tempdir().expect("tempdir");
-    let skill_path = write_skill(&codex_home, "demo", "permissions-macos", "from yaml");
-    let skill_dir = skill_path.parent().expect("skill dir");
-
-    write_skill_metadata_at(
-        skill_dir,
-        r#"
-permissions:
-  macos:
-    macos_preferences: "read_write"
-    macos_automation:
-      - "com.apple.Notes"
-    macos_launch_services: true
-    macos_accessibility: true
-    macos_calendar: true
-"#,
-    );
-
-    let cfg = make_config(&codex_home).await;
-    let outcome = load_skills_for_test(&cfg);
-
-    assert!(
-        outcome.errors.is_empty(),
-        "unexpected errors: {:?}",
-        outcome.errors
-    );
-    assert_eq!(outcome.skills.len(), 1);
-    assert_eq!(
-        outcome.skills[0].permission_profile,
-        Some(PermissionProfile {
-            macos: Some(MacOsSeatbeltProfileExtensions {
-                macos_preferences: MacOsPreferencesPermission::ReadWrite,
-                macos_automation: MacOsAutomationPermission::BundleIds(vec![
-                    "com.apple.Notes".to_string()
-                ],),
-                macos_launch_services: true,
-                macos_accessibility: true,
-                macos_calendar: true,
-                macos_reminders: false,
-                macos_contacts: MacOsContactsPermission::None,
-            }),
-            ..Default::default()
-        })
-    );
-}
-
-#[cfg(not(target_os = "macos"))]
-#[tokio::test]
-async fn loads_skill_macos_permissions_from_yaml_non_macos_does_not_create_profile() {
-    let codex_home = tempfile::tempdir().expect("tempdir");
-    let skill_path = write_skill(&codex_home, "demo", "permissions-macos", "from yaml");
-    let skill_dir = skill_path.parent().expect("skill dir");
-
-    write_skill_metadata_at(
-        skill_dir,
-        r#"
-permissions:
-  macos:
-    macos_preferences: "read_write"
-    macos_automation:
-      - "com.apple.Notes"
-    macos_launch_services: true
-    macos_accessibility: true
-    macos_calendar: true
-"#,
-    );
-
-    let cfg = make_config(&codex_home).await;
-    let outcome = load_skills_for_test(&cfg);
-
-    assert!(
-        outcome.errors.is_empty(),
-        "unexpected errors: {:?}",
-        outcome.errors
-    );
-    assert_eq!(outcome.skills.len(), 1);
-    assert_eq!(
-        outcome.skills[0].permission_profile,
-        Some(PermissionProfile {
-            macos: Some(MacOsSeatbeltProfileExtensions {
-                macos_preferences: MacOsPreferencesPermission::ReadWrite,
-                macos_automation: MacOsAutomationPermission::BundleIds(vec![
-                    "com.apple.Notes".to_string()
-                ],),
-                macos_launch_services: true,
-                macos_accessibility: true,
-                macos_calendar: true,
-                macos_reminders: false,
-                macos_contacts: MacOsContactsPermission::None,
-            }),
-            ..Default::default()
-        })
-    );
-}
-
 #[tokio::test]
 async fn accepts_icon_paths_under_assets_dir() {
     let codex_home = tempfile::tempdir().expect("tempdir");
@@ -988,8 +642,6 @@ async fn accepts_icon_paths_under_assets_dir() {
             }),
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -1030,8 +682,6 @@ async fn ignores_invalid_brand_color() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -1085,8 +735,6 @@ async fn ignores_default_prompt_over_max_length() {
             }),
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -1128,8 +776,6 @@ async fn drops_interface_when_icons_are_invalid() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -1174,8 +820,6 @@ async fn loads_skills_via_symlinked_subdir_for_user_scope() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&shared_skill_path),
             scope: SkillScope::User,
         }]
@@ -1235,8 +879,6 @@ async fn does_not_loop_on_symlink_cycle_for_user_scope() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -1273,8 +915,6 @@ fn loads_skills_via_symlinked_subdir_for_admin_scope() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&shared_skill_path),
             scope: SkillScope::Admin,
         }]
@@ -1314,8 +954,6 @@ async fn loads_skills_via_symlinked_subdir_for_repo_scope() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&linked_skill_path),
             scope: SkillScope::Repo,
         }]
@@ -1383,8 +1021,6 @@ async fn respects_max_scan_depth_for_user_scope() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&within_depth_path),
             scope: SkillScope::User,
         }]
@@ -1412,8 +1048,6 @@ async fn loads_valid_skill() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -1446,8 +1080,6 @@ async fn falls_back_to_directory_name_when_skill_name_is_missing() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -1489,8 +1121,6 @@ async fn namespaces_plugin_skills_using_plugin_name() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -1522,8 +1152,6 @@ async fn loads_short_description_from_metadata() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -1636,8 +1264,6 @@ async fn loads_skills_from_repo_root() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::Repo,
         }]
@@ -1673,8 +1299,6 @@ async fn loads_skills_from_agents_dir_without_codex_dir() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::Repo,
         }]
@@ -1728,8 +1352,6 @@ async fn loads_skills_from_all_codex_dirs_under_project_root() {
                 interface: None,
                 dependencies: None,
                 policy: None,
-                permission_profile: None,
-                managed_network_override: None,
                 path_to_skills_md: normalized(&nested_skill_path),
                 scope: SkillScope::Repo,
             },
@@ -1740,8 +1362,6 @@ async fn loads_skills_from_all_codex_dirs_under_project_root() {
                 interface: None,
                 dependencies: None,
                 policy: None,
-                permission_profile: None,
-                managed_network_override: None,
                 path_to_skills_md: normalized(&root_skill_path),
                 scope: SkillScope::Repo,
             },
@@ -1781,8 +1401,6 @@ async fn loads_skills_from_codex_dir_when_not_git_repo() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::Repo,
         }]
@@ -1820,8 +1438,6 @@ async fn deduplicates_by_path_preferring_first_root() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::Repo,
         }]
@@ -1863,8 +1479,6 @@ async fn keeps_duplicate_names_from_repo_and_user() {
                 interface: None,
                 dependencies: None,
                 policy: None,
-                permission_profile: None,
-                managed_network_override: None,
                 path_to_skills_md: normalized(&repo_skill_path),
                 scope: SkillScope::Repo,
             },
@@ -1875,8 +1489,6 @@ async fn keeps_duplicate_names_from_repo_and_user() {
                 interface: None,
                 dependencies: None,
                 policy: None,
-                permission_profile: None,
-                managed_network_override: None,
                 path_to_skills_md: normalized(&user_skill_path),
                 scope: SkillScope::User,
             },
@@ -1940,8 +1552,6 @@ async fn keeps_duplicate_names_from_nested_codex_dirs() {
                 interface: None,
                 dependencies: None,
                 policy: None,
-                permission_profile: None,
-                managed_network_override: None,
                 path_to_skills_md: first_path,
                 scope: SkillScope::Repo,
             },
@@ -1952,8 +1562,6 @@ async fn keeps_duplicate_names_from_nested_codex_dirs() {
                 interface: None,
                 dependencies: None,
                 policy: None,
-                permission_profile: None,
-                managed_network_override: None,
                 path_to_skills_md: second_path,
                 scope: SkillScope::Repo,
             },
@@ -2025,8 +1633,6 @@ async fn loads_skills_when_cwd_is_file_in_repo() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::Repo,
         }]
@@ -2085,8 +1691,6 @@ async fn loads_skills_from_system_cache_when_present() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::System,
         }]

codex-rs/core-skills/src/manager_tests.rs

@@ -57,8 +57,6 @@ fn test_skill(name: &str, path: PathBuf) -> SkillMetadata {
         interface: None,
         dependencies: None,
         policy: None,
-        permission_profile: None,
-        managed_network_override: None,
         path_to_skills_md: path,
         scope: SkillScope::User,
     }

codex-rs/core-skills/src/model.rs

@@ -3,22 +3,8 @@ use std::collections::HashSet;
 use std::path::PathBuf;
 use std::sync::Arc;
 
-use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::Product;
 use codex_protocol::protocol::SkillScope;
-use serde::Deserialize;
-
-#[derive(Debug, Clone, Default, Deserialize, PartialEq, Eq)]
-pub struct SkillManagedNetworkOverride {
-    pub allowed_domains: Option<Vec<String>>,
-    pub denied_domains: Option<Vec<String>>,
-}
-
-impl SkillManagedNetworkOverride {
-    pub fn has_domain_overrides(&self) -> bool {
-        self.allowed_domains.is_some() || self.denied_domains.is_some()
-    }
-}
 
 #[derive(Debug, Clone, PartialEq)]
 pub struct SkillMetadata {
@@ -28,8 +14,6 @@ pub struct SkillMetadata {
     pub interface: Option<SkillInterface>,
     pub dependencies: Option<SkillDependencies>,
     pub policy: Option<SkillPolicy>,
-    pub permission_profile: Option<PermissionProfile>,
-    pub managed_network_override: Option<SkillManagedNetworkOverride>,
     /// Path to the SKILLS.md file that declares this skill.
     pub path_to_skills_md: PathBuf,
     pub scope: SkillScope,

codex-rs/core/src/mcp/skill_dependencies_tests.rs

@@ -12,8 +12,6 @@ fn skill_with_tools(tools: Vec<SkillToolDependency>) -> SkillMetadata {
         interface: None,
         dependencies: Some(SkillDependencies { tools }),
         policy: None,
-        permission_profile: None,
-        managed_network_override: None,
         path_to_skills_md: PathBuf::from("skill"),
         scope: SkillScope::User,
     }

codex-rs/tui/src/bottom_pane/chat_composer.rs

@@ -5409,8 +5409,6 @@ mod tests {
             }),
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: PathBuf::from("/tmp/repo/google-calendar/SKILL.md"),
             scope: codex_protocol::protocol::SkillScope::Repo,
         }]));
@@ -5501,8 +5499,6 @@ mod tests {
                 }),
                 dependencies: None,
                 policy: None,
-                permission_profile: None,
-                managed_network_override: None,
                 path_to_skills_md: PathBuf::from("/tmp/repo/google-calendar/SKILL.md"),
                 scope: codex_protocol::protocol::SkillScope::Repo,
             }]));

codex-rs/tui/src/bottom_pane/mod.rs

@@ -1708,8 +1708,6 @@ mod tests {
                 interface: None,
                 dependencies: None,
                 policy: None,
-                permission_profile: None,
-                managed_network_override: None,
                 path_to_skills_md: PathBuf::from("test-skill"),
                 scope: SkillScope::User,
             }]),

codex-rs/tui/src/chatwidget/skills.rs

@@ -191,8 +191,6 @@ fn protocol_skill_to_core(skill: &ProtocolSkillMetadata) -> SkillMetadata {
                     .collect(),
             }),
         policy: None,
-        permission_profile: None,
-        managed_network_override: None,
         path_to_skills_md: skill.path.clone(),
         scope: skill.scope,
     }

codex-rs/tui/src/chatwidget/tests.rs

@@ -1049,8 +1049,6 @@ async fn submission_prefers_selected_duplicate_skill_path() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: repo_skill_path,
             scope: SkillScope::Repo,
         },
@@ -1061,8 +1059,6 @@ async fn submission_prefers_selected_duplicate_skill_path() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: user_skill_path.clone(),
             scope: SkillScope::User,
         },

codex-rs/tui_app_server/src/bottom_pane/chat_composer.rs

@@ -5424,8 +5424,6 @@ mod tests {
             }),
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: PathBuf::from("/tmp/repo/google-calendar/SKILL.md"),
             scope: codex_protocol::protocol::SkillScope::Repo,
         }]));
@@ -5516,8 +5514,6 @@ mod tests {
                 }),
                 dependencies: None,
                 policy: None,
-                permission_profile: None,
-                managed_network_override: None,
                 path_to_skills_md: PathBuf::from("/tmp/repo/google-calendar/SKILL.md"),
                 scope: codex_protocol::protocol::SkillScope::Repo,
             }]));

codex-rs/tui_app_server/src/bottom_pane/mod.rs

@@ -1701,8 +1701,6 @@ mod tests {
                 interface: None,
                 dependencies: None,
                 policy: None,
-                permission_profile: None,
-                managed_network_override: None,
                 path_to_skills_md: PathBuf::from("test-skill"),
                 scope: SkillScope::User,
             }]),

codex-rs/tui_app_server/src/chatwidget/skills.rs

@@ -191,8 +191,6 @@ fn protocol_skill_to_core(skill: &ProtocolSkillMetadata) -> SkillMetadata {
                     .collect(),
             }),
         policy: None,
-        permission_profile: None,
-        managed_network_override: None,
         path_to_skills_md: skill.path.clone(),
         scope: skill.scope,
     }

codex-rs/tui_app_server/src/chatwidget/tests.rs

@@ -1078,8 +1078,6 @@ async fn submission_prefers_selected_duplicate_skill_path() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: repo_skill_path,
             scope: SkillScope::Repo,
         },
@@ -1090,8 +1088,6 @@ async fn submission_prefers_selected_duplicate_skill_path() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: user_skill_path.clone(),
             scope: SkillScope::User,
         },