fix: harden generated agent platform access

agent_builder/skills/a2apack-agent-authoring/SKILL.md

@@ -21,6 +21,12 @@ Use `A2AAgent` class attributes for runtime and marketplace behavior:
 - `wants_cp_jwt=True` is only for trusted platform agents. It forwards the
   caller's control-plane token.
 
+For generated/user-owned agents that call an LLM, default to
+`LLMProvisioning.CALLER_PROVIDED` with `Pricing(..., caller_pays_llm=True, ...)`.
+Use `LLMProvisioning.PLATFORM` only when the user explicitly wants
+platform-paid LLM usage. In either mode, read `ctx.llm`; never read
+`A2A_LITELLM_KEY`, provider keys, or platform secrets directly.
+
 Keep each `@skill` method `async`, put `RunContext[...]` immediately after
 `self`, and annotate every public argument. Do not use `*args` or `**kwargs`;
 they are rejected and would not publish a useful schema.

agent_builder/skills/agent-quality-review/SKILL.md

@@ -30,8 +30,13 @@ Check these items:
   arguments.
 - The public schema is small and stable. No unbounded command strings, hidden
   prompt fragments, or provider credentials as public inputs.
-- The implementation reads `ctx.llm` when `llm_provisioning` is
-  `CALLER_PROVIDED`.
+- The implementation reads `ctx.llm` for both `CALLER_PROVIDED` and
+  `PLATFORM` LLM provisioning.
+- Generated/user agents should default to
+  `llm_provisioning = LLMProvisioning.CALLER_PROVIDED` and
+  `Pricing(..., caller_pays_llm=True, ...)`. If the user explicitly wants
+  platform-paid LLM usage, `LLMProvisioning.PLATFORM` is acceptable only if
+  the code still uses `ctx.llm` and never reads LiteLLM/provider keys directly.
 - Any use of DeepAgents file tools passes `backend=ctx.workspace_backend()`.
 - Any project skills are seeded into the backend and passed with
   `skills=skill_sources or None`.
@@ -81,8 +86,8 @@ frontend:
 For React/Vite frontends, expect `frontend/package.json`,
 `frontend/vite.config.js`, `frontend/src/App.jsx`, and `frontend/src/a2a.js`.
 For static frontends, expect `frontend/dist/index.html`. The browser code must
-not contain platform secrets, provider keys, hard-coded deployment URLs, or
-private stack details. It should load `/app/config.json`, use
+not contain platform secrets, provider keys, LiteLLM keys, hard-coded deployment
+URLs, or private stack details. It should load `/app/config.json`, use
 `/app/a2a-client.js` or generated config endpoints, and call only the public
 `@skill` schemas.