diff --git a/.gitea/workflows/scripts/install-caller-skills.sh b/.gitea/workflows/scripts/install-caller-skills.sh
index 84ba3a4..6e3e664 100644
--- a/.gitea/workflows/scripts/install-caller-skills.sh
+++ b/.gitea/workflows/scripts/install-caller-skills.sh
@@ -26,6 +26,8 @@
 # decode them inside setup.sh. Single-line values mask correctly.
 set -eu
 
+# Safe default for SECRETS_JSON (see note at the setup.sh call below re: the ${x:-{}} brace bug).
+SJ="${SECRETS_JSON:-}"; [ -n "$SJ" ] || SJ='{}'
 DIR="${WORKSPACE:-$GITHUB_WORKSPACE}/.gitea/agent-skills"
 CFG="$HOME/.config/opencode/opencode.json"
 [ -d "$DIR" ] || { echo "no caller skills (.gitea/agent-skills/ absent) — nothing to install"; exit 0; }
@@ -48,9 +50,12 @@ for skill_dir in "$DIR"/*/; do
   cp "$md" "$dest/SKILL.md"
   chmod -R o=rX "$dest"
   # Optional runtime setup, with all inherited secrets available as JSON (never printed here).
+  # NOTE: pass SECRETS_JSON via a plain variable — do NOT inline ${SECRETS_JSON:-{}} here or in
+  # setup.sh: bash brace-matching appends a stray '}' when the var is set, corrupting the JSON so
+  # the skill's `jq` fails ("Unmatched '}'") and the skill is silently skipped.
   if [ -f "$skill_dir/setup.sh" ]; then
     echo "caller skill '$name': running setup.sh for @$NAME"
-    SECRETS_JSON="${SECRETS_JSON:-{}}" NAME="$NAME" WORKSPACE="${WORKSPACE:-$GITHUB_WORKSPACE}" \
+    SECRETS_JSON="$SJ" NAME="$NAME" WORKSPACE="${WORKSPACE:-$GITHUB_WORKSPACE}" \
       bash "$skill_dir/setup.sh" || { echo "caller skill '$name': setup.sh failed — skipping this skill"; continue; }
   fi
   allow=$(jq -nc --argjson a "$allow" --arg n "$name" '$a + {($n):"allow"}')