fix(thermos): Pass rubric paths to review subagents

[kmsquire]

Summary

• Task subagents cannot execute /thermos or discover plugin skill files, so instructing them to "load the thermo-nuclear-* skill" wastes startup hunting for skills that never resolve.
• Parents (thermos skill / any orchestrator) now resolve absolute SKILL.md paths (or inline the rubric body) and pass them in each Task prompt.
• Subagent agent defs prefer parent-provided path / ### Rubric (inlined) and explicitly forbid filesystem skill searches and slash-skill invocation.
• Bump Thermos to 1.0.1; document the parent contract in README and CHANGELOG.

Test plan

• Invoke /thermos (or spawn both thermo review subagents) with a small branch diff
• Confirm subagents Read the provided rubric path and do not search for thermos skills at startup
• Confirm findings still reflect the security and code-quality rubrics
• Confirm fallback still works when parent omits path and inlined rubric (degraded but usable review)

Made with Cursor

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

^{Reviewed by Cursor Bugbot for commit 3f24066. Configure here.}

[cursor]

Incomplete rubric path search

Medium Severity · Bugbot Rules

The new rubric path search skips the standard Cursor skill install locations (workspace .cursor/skills/ and user ~/.cursor/skills/) and only checks $HOME/.claude/skills/ plus a narrow cursor-public/thermos cache glob. Skill detection that routes to other skills needs all three install roots, including general ~/.cursor/plugins/ (local and team marketplace too). Missed paths leave parents unable to pass rubrics, so subagents fall back to a degraded review.

 

^{Triggered by learned rule: Skill detection must cover all installation paths}

^{Reviewed by Cursor Bugbot for commit 3f24066. Configure here.}