Routing Rules and Constraints in Patent-Disclosure-Skill to Prevent Capability Confusion

The patent-disclosure-skill implements a guard-rails-first routing model that explicitly separates sub-skill responsibilities through mandatory guardrails validation, unique trigger tokens, and deterministic fallbacks to stop the skill from invoking the wrong capability.

Patent-related tasks demand precision—confusing a disclosure draft with an office action response could derail an entire filing strategy. The handsomestWei/patent-disclosure-skill repository solves this through a deterministic routing architecture baked into every sub-skill definition. This article breaks down the exact mechanisms that prevent capability confusion, with references to the source files where these rules are enforced.

Guardrails-First Entry Points

Every sub-skill in the repository begins with a mandatory guardrails check before any user-facing prompt executes. According to the skill definitions in skills/patent-disclosure/SKILL.md and skills/patent-application/SKILL.md, the entry pipeline follows this strict sequence:

1. Read the skill's own prompts/guardrails.md
2. Proceed to the intake prompt (e.g., intake.md) only if guardrails pass

This ordering is non-negotiable. The routing layer enforces it at the metadata level, not as a convention. If the guardrails file is missing or fails validation, the skill refuses to initialize.

The guardrails file at skills/patent-disclosure/prompts/guardrails.md (and equivalents for other sub-skills) contains hard constraints such as:

• Never invoke another skill unless the user explicitly requests it
• If the user mentions a different domain, abort and ask for clarification

These rules execute before any downstream processing, guaranteeing that cross-skill contamination cannot occur through prompt injection or ambiguous phrasing.

Explicit Trigger Token Matching

Each sub-skill declares unique trigger phrases in its SKILL.md metadata. The routing engine only activates a skill when these exact tokens appear in user input—and only after guardrails validation succeeds.

Sub-Skill	Trigger Token	Definition File
Patent disclosure	"交底书"	skills/patent-disclosure/SKILL.md
Patent application	"申请文件"	skills/patent-application/SKILL.md
Office action response	"审查答复"	skills/patent-oa/SKILL.md
Examination policy brief	"政策简报"	skills/patent-exam-policy/SKILL.md

As documented in the repository's README.md under the sub-skill list section, these triggers are mutually exclusive by design. No two capabilities share the same token, eliminating overlap that could confuse the router.

The routing engine creates a one-to-one map between each trigger and its implementation. This is not fuzzy matching—it is exact token presence detection after context validation.

Capability Isolation in SKILL.md Metadata

Each SKILL.md file encodes three critical elements that enforce isolation:

• Capabilities list: What the skill can do
• Triggers: The exact phrases that activate it
• Guardrails link: Path to the constraint file that governs behavior

In skills/patent-disclosure/SKILL.md, for example, the metadata explicitly links the "交底书" trigger to its guardrails before any prompt chain begins. The routing engine parses this metadata to build its activation table at initialization—no runtime ambiguity is possible.

This structure prevents the common failure mode where similar-sounding requests ("draft a patent document" vs. "draft patent application") could activate multiple skills simultaneously.

Deterministic Routing Pipeline

The complete routing flow operates as a strict state machine:

def route(user_input, current_skill_context):
    # 1️⃣ Guardrails validation (MUST pass first)

    if not guardrails_passed(current_skill_context):
        return "Please clarify which function you need."
    
    # 2️⃣ Trigger matching against registered tokens

    for skill in registered_skills:
        if any(trigger == extract_trigger(user_input) 
               for trigger in skill.triggers):
            return skill.execute(user_input)
    
    # 3️⃣ Fallback on ambiguity—never guess

    return "I'm not sure which function you need – could you clarify?"

The guardrails_passed() function loads the skill's guardrails.md and enforces constraints before any trigger evaluation occurs:

def guardrails_passed(skill_context):
    """
    Validate that the current request stays within skill boundaries.
    Returns False if cross-skill invocation is detected.
    """
    guardrails = load_markdown(
        f"skills/{skill_context.name}/prompts/guardrails.md"
    )
    
    # Explicit constraint checks

    if "domain_mismatch" in skill_context.detected_entities:
        return False  # Abort per "different domain" rule

    
    if skill_context.detected_skill_references:
        # Check for unauthorized cross-skill calls

        return all(
            ref == skill_context.name 
            for ref in skill_context.detected_skill_references
        )
    
    return True

This pipeline guarantees three invariants:

1. Guardrails always execute first—no prompt reaches the LLM without boundary validation
2. Triggers are exact matches—no fuzzy similarity scoring that could select the wrong skill
3. Ambiguity triggers fallback—the system asks rather than guesses

Fail-Safe Fallback Behavior

When trigger matching fails or guardrails detect boundary violations, the routing layer returns a clarification request rather than selecting the "closest" skill. This fallback is implemented in the central router and applies universally:

"I didn't understand the request" or "I'm not sure which function you need – could you clarify?"

This prevents the drift behavior seen in less constrained systems, where a model might progressively escalate a simple disclosure request into full application drafting through "helpful" over-interpretation.

The fallback is the default terminal state in the routing state machine—not an error condition to recover from, but the correct behavior when constraints are violated.

Key Source Files and Their Roles

File Path	Routing Function
skills/patent-disclosure/SKILL.md	Defines "交底书" trigger, links to guardrails
skills/patent-application/SKILL.md	Defines "申请文件" trigger, links to guardrails
skills/patent-oa/SKILL.md	Defines "审查答复" trigger, links to guardrails
skills/patent-exam-policy/SKILL.md	Defines "政策简报" trigger, links to guardrails
skills/*/prompts/guardrails.md	Contains cross-skill invocation constraints
README.md	Documents sub-skill trigger vocabulary

These files collectively implement the guard-rails-first routing model that prevents capability confusion through structural enforcement, not prompt engineering alone.

Summary

• Guardrails execute first: Every sub-skill validates boundaries via prompts/guardrails.md before any user prompt processing
• Triggers are unique and exact: Mutually exclusive tokens like "交底书" and "申请文件" eliminate activation overlap
• Metadata-driven isolation: SKILL.md files encode one-to-one trigger-to-capability mappings parsed at initialization
• Ambiguity triggers fallback: The system asks for clarification rather than guessing when constraints are violated
• Constraint enforcement is structural: Rules like "never invoke another skill" are checked in code, not merely suggested in prompts

Frequently Asked Questions

What happens if a user's input matches multiple trigger tokens?

According to the routing implementation in handsomestWei/patent-disclosure-skill, this scenario cannot occur by design—triggers are mutually exclusive. If preprocessing detects multiple potential matches or no clear match, the fallback behavior activates: the system requests clarification rather than selecting arbitrarily. The guardrails validation step also catches context mismatches before trigger evaluation begins.

Can a sub-skill invoke another sub-skill during execution?

No. The guardrails.md constraint "Never invoke another skill unless the user explicitly requests it" is evaluated at the entry point and monitored throughout execution. The routing layer enforces this structurally, not merely through prompt instructions. Any detected cross-skill reference aborts the current pipeline and triggers the clarification fallback.

Where are the trigger tokens defined and maintained?

Each sub-skill declares its triggers in its respective SKILL.md file: skills/patent-disclosure/SKILL.md for "交底书", skills/patent-application/SKILL.md for "申请文件", and so forth. The README.md provides a consolidated overview of all sub-skills and their trigger vocabulary, but the canonical definitions reside in the individual skill metadata files that the routing engine parses.

How does the system handle inputs that mention patent concepts but lack explicit triggers?

Such inputs fail both guardrails validation (no recognized domain context) and trigger matching (no exact token match). The routing pipeline terminates at the fallback state, returning a clarification request. This prevents the system from defaulting to a "best guess" skill based on semantic similarity, which would risk capability confusion in high-stakes patent workflows.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}