diff --git a/.changeset/agent-skill-shared-reference.md b/.changeset/agent-skill-shared-reference.md
new file mode 100644
index 00000000..96d2e801
--- /dev/null
+++ b/.changeset/agent-skill-shared-reference.md
@@ -0,0 +1,5 @@
+---
+"@googleworkspace/cli": patch
+---
+
+Clarify generated skills treat gws-shared as reference material for agent environments.
diff --git a/crates/google-workspace-cli/src/generate_skills.rs b/crates/google-workspace-cli/src/generate_skills.rs
index ce265407..6feddd72 100644
--- a/crates/google-workspace-cli/src/generate_skills.rs
+++ b/crates/google-workspace-cli/src/generate_skills.rs
@@ -26,6 +26,12 @@ use std::path::Path;
 
 const PERSONAS_TOML: &str = include_str!("../registry/personas.toml");
 const RECIPES_TOML: &str = include_str!("../registry/recipes.toml");
+const SHARED_REFERENCE_NOTE: &str = concat!(
+    "> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, ",
+    "and security rules. Treat it as background guidance; do not run auth, ",
+    "setup, cache, or `gws generate-skills` commands unless the user explicitly ",
+    "asks or a command fails because setup is missing.\n\n"
+);
 
 /// Methods blocked from skill generation.
 /// Format: (service_alias, resource, method).
@@ -403,9 +409,7 @@ metadata:
     let api_version = entry.version;
     out.push_str(&format!("# {alias} ({api_version})\n\n"));
 
-    out.push_str(
-        "> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.\n\n",
-    );
+    out.push_str(SHARED_REFERENCE_NOTE);
 
     out.push_str(&format!(
         "```bash\ngws {alias} <resource> <method> [flags]\n```\n\n",
@@ -540,9 +544,7 @@ metadata:
     // Title
     out.push_str(&format!("# {alias} {cmd_name}\n\n"));
 
-    out.push_str(
-        "> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.\n\n",
-    );
+    out.push_str(SHARED_REFERENCE_NOTE);
 
     out.push_str(&format!("{about}\n\n"));
 
@@ -730,6 +732,13 @@ gws <service> <resource> [sub-resource] <method> [flags]
 - Prefer `--dry-run` for destructive operations
 - Use `--sanitize` for PII/content safety screening
 
+## Agent and Sandbox Use
+
+- Treat this file as reference material, not a startup checklist
+- Assume `gws` is already installed and authenticated unless the requested command fails
+- Do not run auth, setup, cache, or `gws generate-skills` commands unless the user asks or setup is required to recover from a specific failure
+- In read-only or locked-down environments, prefer the requested read-only helper command directly and report missing filesystem or auth access instead of probing the environment
+
 ## Shell Tips
 
 - **zsh `!` expansion:** Sheet ranges like `Sheet1!A1` contain `!` which zsh interprets as history expansion. Use double quotes with escaped inner quotes instead of single quotes:
@@ -1274,6 +1283,14 @@ mod tests {
             fm.contains("- gws"),
             "frontmatter should contain '- gws' block entry"
         );
+        assert!(
+            md.contains("Treat it as background guidance"),
+            "service skills should describe gws-shared as reference material"
+        );
+        assert!(
+            !md.contains("PREREQUISITE"),
+            "service skills should not require reading gws-shared before use"
+        );
     }
 
     #[test]
@@ -1291,6 +1308,14 @@ mod tests {
             fm.contains("- gws"),
             "shared skill frontmatter should contain '- gws'"
         );
+        assert!(
+            content.contains("## Agent and Sandbox Use"),
+            "shared skill should include agent and sandbox guidance"
+        );
+        assert!(
+            content.contains("not a startup checklist"),
+            "shared skill should not be interpreted as required startup steps"
+        );
     }
 
     #[test]
diff --git a/skills/gws-admin-reports/SKILL.md b/skills/gws-admin-reports/SKILL.md
index 4c9eae17..d7fa2de6 100644
--- a/skills/gws-admin-reports/SKILL.md
+++ b/skills/gws-admin-reports/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # admin-reports (reports_v1)
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 ```bash
 gws admin-reports <resource> <method> [flags]
diff --git a/skills/gws-calendar-agenda/SKILL.md b/skills/gws-calendar-agenda/SKILL.md
index 89259ff3..f012f3c2 100644
--- a/skills/gws-calendar-agenda/SKILL.md
+++ b/skills/gws-calendar-agenda/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # calendar +agenda
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Show upcoming events across all calendars
 
diff --git a/skills/gws-calendar-insert/SKILL.md b/skills/gws-calendar-insert/SKILL.md
index dd2989d8..3cea85fb 100644
--- a/skills/gws-calendar-insert/SKILL.md
+++ b/skills/gws-calendar-insert/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # calendar +insert
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 create a new event
 
diff --git a/skills/gws-calendar/SKILL.md b/skills/gws-calendar/SKILL.md
index 08e134ce..9b0d00e4 100644
--- a/skills/gws-calendar/SKILL.md
+++ b/skills/gws-calendar/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # calendar (v3)
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 ```bash
 gws calendar <resource> <method> [flags]
diff --git a/skills/gws-chat-send/SKILL.md b/skills/gws-chat-send/SKILL.md
index 3ac2e237..4bb8da3d 100644
--- a/skills/gws-chat-send/SKILL.md
+++ b/skills/gws-chat-send/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # chat +send
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Send a message to a space
 
diff --git a/skills/gws-chat/SKILL.md b/skills/gws-chat/SKILL.md
index 5eaca50c..26e4c852 100644
--- a/skills/gws-chat/SKILL.md
+++ b/skills/gws-chat/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # chat (v1)
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 ```bash
 gws chat <resource> <method> [flags]
diff --git a/skills/gws-classroom/SKILL.md b/skills/gws-classroom/SKILL.md
index 466a7105..c0da1ad0 100644
--- a/skills/gws-classroom/SKILL.md
+++ b/skills/gws-classroom/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # classroom (v1)
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 ```bash
 gws classroom <resource> <method> [flags]
diff --git a/skills/gws-docs-write/SKILL.md b/skills/gws-docs-write/SKILL.md
index 4c903126..1903b412 100644
--- a/skills/gws-docs-write/SKILL.md
+++ b/skills/gws-docs-write/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # docs +write
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Append text to a document
 
diff --git a/skills/gws-docs/SKILL.md b/skills/gws-docs/SKILL.md
index f51b1950..0635218f 100644
--- a/skills/gws-docs/SKILL.md
+++ b/skills/gws-docs/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # docs (v1)
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 ```bash
 gws docs <resource> <method> [flags]
diff --git a/skills/gws-drive-upload/SKILL.md b/skills/gws-drive-upload/SKILL.md
index fe2b4017..eb7db07c 100644
--- a/skills/gws-drive-upload/SKILL.md
+++ b/skills/gws-drive-upload/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # drive +upload
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Upload a file with automatic metadata
 
diff --git a/skills/gws-drive/SKILL.md b/skills/gws-drive/SKILL.md
index d4debbdb..0b1d2430 100644
--- a/skills/gws-drive/SKILL.md
+++ b/skills/gws-drive/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # drive (v3)
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 ```bash
 gws drive <resource> <method> [flags]
diff --git a/skills/gws-events-renew/SKILL.md b/skills/gws-events-renew/SKILL.md
index bb825ed7..c711aea2 100644
--- a/skills/gws-events-renew/SKILL.md
+++ b/skills/gws-events-renew/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # events +renew
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Renew/reactivate Workspace Events subscriptions
 
diff --git a/skills/gws-events-subscribe/SKILL.md b/skills/gws-events-subscribe/SKILL.md
index f2e45e90..2907ee93 100644
--- a/skills/gws-events-subscribe/SKILL.md
+++ b/skills/gws-events-subscribe/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # events +subscribe
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Subscribe to Workspace events and stream them as NDJSON
 
diff --git a/skills/gws-events/SKILL.md b/skills/gws-events/SKILL.md
index e72f5124..1b1002d4 100644
--- a/skills/gws-events/SKILL.md
+++ b/skills/gws-events/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # events (v1)
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 ```bash
 gws events <resource> <method> [flags]
diff --git a/skills/gws-forms/SKILL.md b/skills/gws-forms/SKILL.md
index 3a11a94e..098a5201 100644
--- a/skills/gws-forms/SKILL.md
+++ b/skills/gws-forms/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # forms (v1)
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 ```bash
 gws forms <resource> <method> [flags]
diff --git a/skills/gws-gmail-forward/SKILL.md b/skills/gws-gmail-forward/SKILL.md
index d433cef5..e2e4675c 100644
--- a/skills/gws-gmail-forward/SKILL.md
+++ b/skills/gws-gmail-forward/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # gmail +forward
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Forward a message to new recipients
 
diff --git a/skills/gws-gmail-read/SKILL.md b/skills/gws-gmail-read/SKILL.md
index dc153af4..ebd01cf1 100644
--- a/skills/gws-gmail-read/SKILL.md
+++ b/skills/gws-gmail-read/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # gmail +read
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Read a message and extract its body or headers
 
diff --git a/skills/gws-gmail-reply-all/SKILL.md b/skills/gws-gmail-reply-all/SKILL.md
index 1a4e4c8b..0238d201 100644
--- a/skills/gws-gmail-reply-all/SKILL.md
+++ b/skills/gws-gmail-reply-all/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # gmail +reply-all
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Reply-all to a message (handles threading automatically)
 
diff --git a/skills/gws-gmail-reply/SKILL.md b/skills/gws-gmail-reply/SKILL.md
index e3538827..ec081d9f 100644
--- a/skills/gws-gmail-reply/SKILL.md
+++ b/skills/gws-gmail-reply/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # gmail +reply
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Reply to a message (handles threading automatically)
 
diff --git a/skills/gws-gmail-send/SKILL.md b/skills/gws-gmail-send/SKILL.md
index 55da9c28..22d663c3 100644
--- a/skills/gws-gmail-send/SKILL.md
+++ b/skills/gws-gmail-send/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # gmail +send
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Send an email
 
diff --git a/skills/gws-gmail-triage/SKILL.md b/skills/gws-gmail-triage/SKILL.md
index 641a2d11..a5451777 100644
--- a/skills/gws-gmail-triage/SKILL.md
+++ b/skills/gws-gmail-triage/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # gmail +triage
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Show unread inbox summary (sender, subject, date)
 
diff --git a/skills/gws-gmail-watch/SKILL.md b/skills/gws-gmail-watch/SKILL.md
index fca780f7..46561892 100644
--- a/skills/gws-gmail-watch/SKILL.md
+++ b/skills/gws-gmail-watch/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # gmail +watch
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Watch for new emails and stream them as NDJSON
 
diff --git a/skills/gws-gmail/SKILL.md b/skills/gws-gmail/SKILL.md
index 3423770e..de9c46c9 100644
--- a/skills/gws-gmail/SKILL.md
+++ b/skills/gws-gmail/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # gmail (v1)
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 ```bash
 gws gmail <resource> <method> [flags]
diff --git a/skills/gws-keep/SKILL.md b/skills/gws-keep/SKILL.md
index 8c2d0bf4..30cca01a 100644
--- a/skills/gws-keep/SKILL.md
+++ b/skills/gws-keep/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # keep (v1)
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 ```bash
 gws keep <resource> <method> [flags]
diff --git a/skills/gws-meet/SKILL.md b/skills/gws-meet/SKILL.md
index 6959c2bd..bb9f0da1 100644
--- a/skills/gws-meet/SKILL.md
+++ b/skills/gws-meet/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # meet (v2)
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 ```bash
 gws meet <resource> <method> [flags]
diff --git a/skills/gws-modelarmor-create-template/SKILL.md b/skills/gws-modelarmor-create-template/SKILL.md
index 3926280e..fd609c73 100644
--- a/skills/gws-modelarmor-create-template/SKILL.md
+++ b/skills/gws-modelarmor-create-template/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # modelarmor +create-template
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Create a new Model Armor template
 
diff --git a/skills/gws-modelarmor-sanitize-prompt/SKILL.md b/skills/gws-modelarmor-sanitize-prompt/SKILL.md
index cff9dde9..dcbf4be1 100644
--- a/skills/gws-modelarmor-sanitize-prompt/SKILL.md
+++ b/skills/gws-modelarmor-sanitize-prompt/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # modelarmor +sanitize-prompt
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Sanitize a user prompt through a Model Armor template
 
diff --git a/skills/gws-modelarmor-sanitize-response/SKILL.md b/skills/gws-modelarmor-sanitize-response/SKILL.md
index b4cd60fa..5050f3de 100644
--- a/skills/gws-modelarmor-sanitize-response/SKILL.md
+++ b/skills/gws-modelarmor-sanitize-response/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # modelarmor +sanitize-response
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Sanitize a model response through a Model Armor template
 
diff --git a/skills/gws-modelarmor/SKILL.md b/skills/gws-modelarmor/SKILL.md
index 15efca47..e55888b9 100644
--- a/skills/gws-modelarmor/SKILL.md
+++ b/skills/gws-modelarmor/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # modelarmor (v1)
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 ```bash
 gws modelarmor <resource> <method> [flags]
diff --git a/skills/gws-people/SKILL.md b/skills/gws-people/SKILL.md
index 06527a73..bfd25c78 100644
--- a/skills/gws-people/SKILL.md
+++ b/skills/gws-people/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # people (v1)
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 ```bash
 gws people <resource> <method> [flags]
diff --git a/skills/gws-script-push/SKILL.md b/skills/gws-script-push/SKILL.md
index c3920af2..8fd13584 100644
--- a/skills/gws-script-push/SKILL.md
+++ b/skills/gws-script-push/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # script +push
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Upload local files to an Apps Script project
 
diff --git a/skills/gws-script/SKILL.md b/skills/gws-script/SKILL.md
index e7e288aa..27ff1fe5 100644
--- a/skills/gws-script/SKILL.md
+++ b/skills/gws-script/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # script (v1)
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 ```bash
 gws script <resource> <method> [flags]
diff --git a/skills/gws-shared/SKILL.md b/skills/gws-shared/SKILL.md
index dc6a3223..596caeae 100644
--- a/skills/gws-shared/SKILL.md
+++ b/skills/gws-shared/SKILL.md
@@ -59,6 +59,13 @@ gws <service> <resource> [sub-resource] <method> [flags]
 - Prefer `--dry-run` for destructive operations
 - Use `--sanitize` for PII/content safety screening
 
+## Agent and Sandbox Use
+
+- Treat this file as reference material, not a startup checklist
+- Assume `gws` is already installed and authenticated unless the requested command fails
+- Do not run auth, setup, cache, or `gws generate-skills` commands unless the user asks or setup is required to recover from a specific failure
+- In read-only or locked-down environments, prefer the requested read-only helper command directly and report missing filesystem or auth access instead of probing the environment
+
 ## Shell Tips
 
 - **zsh `!` expansion:** Sheet ranges like `Sheet1!A1` contain `!` which zsh interprets as history expansion. Use double quotes with escaped inner quotes instead of single quotes:
diff --git a/skills/gws-sheets-append/SKILL.md b/skills/gws-sheets-append/SKILL.md
index cac70a28..081c15f7 100644
--- a/skills/gws-sheets-append/SKILL.md
+++ b/skills/gws-sheets-append/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # sheets +append
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Append a row to a spreadsheet
 
diff --git a/skills/gws-sheets-read/SKILL.md b/skills/gws-sheets-read/SKILL.md
index a1711dc3..ee2f2f2c 100644
--- a/skills/gws-sheets-read/SKILL.md
+++ b/skills/gws-sheets-read/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # sheets +read
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Read values from a spreadsheet
 
diff --git a/skills/gws-sheets/SKILL.md b/skills/gws-sheets/SKILL.md
index d713253d..9f7f4eb0 100644
--- a/skills/gws-sheets/SKILL.md
+++ b/skills/gws-sheets/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # sheets (v4)
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 ```bash
 gws sheets <resource> <method> [flags]
diff --git a/skills/gws-slides/SKILL.md b/skills/gws-slides/SKILL.md
index afa06f97..5e2f071d 100644
--- a/skills/gws-slides/SKILL.md
+++ b/skills/gws-slides/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # slides (v1)
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 ```bash
 gws slides <resource> <method> [flags]
diff --git a/skills/gws-tasks/SKILL.md b/skills/gws-tasks/SKILL.md
index da4b44d1..7e5185ff 100644
--- a/skills/gws-tasks/SKILL.md
+++ b/skills/gws-tasks/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # tasks (v1)
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 ```bash
 gws tasks <resource> <method> [flags]
diff --git a/skills/gws-workflow-email-to-task/SKILL.md b/skills/gws-workflow-email-to-task/SKILL.md
index bf9456d7..0571a860 100644
--- a/skills/gws-workflow-email-to-task/SKILL.md
+++ b/skills/gws-workflow-email-to-task/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # workflow +email-to-task
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Convert a Gmail message into a Google Tasks entry
 
diff --git a/skills/gws-workflow-file-announce/SKILL.md b/skills/gws-workflow-file-announce/SKILL.md
index 0937cd68..4be5036f 100644
--- a/skills/gws-workflow-file-announce/SKILL.md
+++ b/skills/gws-workflow-file-announce/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # workflow +file-announce
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Announce a Drive file in a Chat space
 
diff --git a/skills/gws-workflow-meeting-prep/SKILL.md b/skills/gws-workflow-meeting-prep/SKILL.md
index f0edea82..94f121d4 100644
--- a/skills/gws-workflow-meeting-prep/SKILL.md
+++ b/skills/gws-workflow-meeting-prep/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # workflow +meeting-prep
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Prepare for your next meeting: agenda, attendees, and linked docs
 
diff --git a/skills/gws-workflow-standup-report/SKILL.md b/skills/gws-workflow-standup-report/SKILL.md
index 9b1a8c91..2ab8a493 100644
--- a/skills/gws-workflow-standup-report/SKILL.md
+++ b/skills/gws-workflow-standup-report/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # workflow +standup-report
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Today's meetings + open tasks as a standup summary
 
diff --git a/skills/gws-workflow-weekly-digest/SKILL.md b/skills/gws-workflow-weekly-digest/SKILL.md
index f07df867..1ef4d816 100644
--- a/skills/gws-workflow-weekly-digest/SKILL.md
+++ b/skills/gws-workflow-weekly-digest/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # workflow +weekly-digest
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 Weekly summary: this week's meetings + unread email count
 
diff --git a/skills/gws-workflow/SKILL.md b/skills/gws-workflow/SKILL.md
index 4078e159..db322436 100644
--- a/skills/gws-workflow/SKILL.md
+++ b/skills/gws-workflow/SKILL.md
@@ -13,7 +13,7 @@ metadata:
 
 # workflow (v1)
 
-> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+> **REFERENCE:** See `../gws-shared/SKILL.md` for auth, global flags, and security rules. Treat it as background guidance; do not run auth, setup, cache, or `gws generate-skills` commands unless the user explicitly asks or a command fails because setup is missing.
 
 ```bash
 gws workflow <resource> <method> [flags]