fix(skills): reject a blank version pin instead of floating to latest

A blank `version` passed to `download_skill` read as "unpinned" and quietly
resolved the latest version, which is not what a caller supplying one asked
for — and it disagreed with `parse_skill_ref`, which already rejects empty
pins. Not reachable through `resolve_registry_ref` or the Agent Repository
auto-pinning, both of which only ever pass a non-empty version.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: joaomdmoura

lib/crewai/src/crewai/skills/registry.py

@@ -279,11 +279,23 @@ def download_skill(
 
     Returns:
         The downloaded Skill at INSTRUCTIONS level.
+
+    Raises:
+        ValueError: If *version* is given but blank.
     """
     from crewai.skills.loader import activate_skill
     from crewai.skills.parser import load_skill_metadata
     from crewai.utilities.agent_utils import resolve_plus_response
 
+    if version is not None:
+        # A blank pin would otherwise read as "unpinned" and quietly float to
+        # the latest version, which is not what a caller passing one asked for.
+        version = version.strip()
+        if not version:
+            raise ValueError(
+                "A pinned skill version must be non-empty; omit it to fetch the latest."
+            )
+
     ref = str(SkillRef(org=org, name=name, version=version))
 
     try:

lib/crewai/tests/skills/test_registry.py

@@ -438,6 +438,18 @@ def get_skill(self, org: str, name: str) -> MagicMock:
 
         assert calls == [("acme", "my-skill")]
 
+    @pytest.mark.parametrize("version", ["", "   "], ids=["empty", "whitespace"])
+    def test_rejects_a_blank_pin_rather_than_floating_to_latest(
+        self, monkeypatch: pytest.MonkeyPatch, version: str
+    ) -> None:
+        installed = _stub_api("my-skill")
+        _install_client(monkeypatch, installed)
+
+        with pytest.raises(ValueError, match="must be non-empty"):
+            download_skill("acme", "my-skill", version=version)
+
+        installed.get_skill.assert_not_called()
+
     def test_reports_the_pinned_ref_when_the_download_fails(
         self, monkeypatch: pytest.MonkeyPatch
     ) -> None: