Core now has a repository-grounding skill that answers "what already governs these paths?" from the repository alone, and can add evidence from a code-intelligence tool your agent already has. Provider evidence is labelled, its limits are kept, a claim that conflicts with source never decides the answer, and with no tool installed the answer is the same.
A path or file: URI a provider returns is read only if the file sits inside the repository or a folder that you or the calling workflow approved. Symlinks, hard links, non-regular and oversized files are refused with a stated reason, and the locator text never reaches a command line raw, so shell metacharacters in it cannot run.