Skills emit unescaped XML metacharacters into model context

Description

Skill metadata and resource paths are inserted into XML-like model context without consistently escaping XML metacharacters.

Skill.fmt(..., { verbose: true }) escapes location, but inserts description directly. The skill tool also inserts sampled file paths directly into <file> elements. Valid descriptions and filesystem paths can contain characters such as &, <, and >, which makes the model-visible structure malformed or ambiguous.

Plugins

None

OpenCode version

1.18.10; also present on dev at 4d68d30b

Steps to reproduce

1. Create a skill with this valid frontmatter:

   ---
   name: comparison
   description: Compare A < B & C
   ---
   

2. Add a sampled resource such as references/a&b.md.

3. Inspect the available-skills context and the output returned by the skill tool.

Current output contains raw dynamic values:

<description>Compare A < B & C</description>
<file>/path/to/references/a&b.md</file>

Expected output escapes those values:

<description>Compare A &lt; B &amp; C</description>
<file>/path/to/references/a&amp;b.md</file>

A focused fix can reuse the existing escapeHtml helper and add regression coverage around Skill.fmt and the skill tool output.

Screenshot and/or share link

Not applicable

Operating System

macOS

Terminal

zsh