v0.18.7 — skills, memory-graph & native-tools hardening

Eighth adversarial review (skills/skill_md, memory graph, native tools) — 11 real bugs the test suite missed, all fixed and regression-tested. 71 bugs found across eleven surfaces so far.

Security

• SSRF guard on browser and download_media. Both fetch a model-/content-supplied URL (Playwright page.goto, yt-dlp) with no host validation — the agent could be steered into http://169.254.169.254/… (cloud metadata) or an internal service. Both now run the same check_url guard http_get already had.
• glob can no longer escape the workspace. A ../../etc/passwd pattern (pathlib returns the escaping path) or a symlink crossing leaked files outside the root; each match is now resolved and dropped unless it stays under the workspace.
• read_document output is data-fenced. A PDF/DOCX/HTML can carry a prompt injection like a web page; its text was returned raw — now defanged + fenced.
• Skill import no longer launders a probationary status. provisional (on-probation) and unknown statuses collapsed to active; the real status now round-trips, unknown → pending.

Fixed

• Graph recall matches whole words, not substrings (a short entity like Go/AI matched inside good/brainstorm).
• Malformed SKILL.md frontmatter is treated as body-only instead of crashing the parser.
• Memory graph save is atomic (temp + replace); load/from_dict survive a corrupt or partial file.
• memory graph builds only from clean (untainted) memories.

Gate: 1418 passed / 3 skipped, mypy + ruff green.

Install: pip install --upgrade 'chimera-agent[full]'