diff --git a/strix/tools/agents_graph/tools.py b/strix/tools/agents_graph/tools.py
index 553d094fa..28a8c622f 100644
--- a/strix/tools/agents_graph/tools.py
+++ b/strix/tools/agents_graph/tools.py
@@ -419,12 +419,23 @@ async def create_agent(
             default=str,
         )
 
-    # Tolerate LLM providers that pass array params as JSON-encoded strings
+    # Tolerate LLM providers that pass array params as JSON-encoded strings.
+    # Validate decoded shape: reject anything that isn't a list of strings.
     if isinstance(skills, str):
+        original_skills = skills
         try:
-            skills = json.loads(skills)
+            decoded_skills = json.loads(skills)
         except json.JSONDecodeError:
             skills = [s.strip() for s in skills.split(",") if s.strip()]
+        else:
+            if isinstance(decoded_skills, str):
+                skills = [decoded_skills]
+            elif isinstance(decoded_skills, list) and all(
+                isinstance(skill, str) for skill in decoded_skills
+            ):
+                skills = decoded_skills
+            else:
+                skills = [original_skills]
     skill_list = list(skills or [])
     skill_error = validate_requested_skills(skill_list)
     if skill_error:
diff --git a/strix/tools/load_skill/tool.py b/strix/tools/load_skill/tool.py
index f5e98b774..b3c7e413e 100644
--- a/strix/tools/load_skill/tool.py
+++ b/strix/tools/load_skill/tool.py
@@ -27,12 +27,23 @@ async def load_skill(ctx: RunContextWrapper, skills: str | list[str]) -> str:
             ``strix/skills/<category>/<name>.md``.
     """
     del ctx
-    # Tolerate LLM providers that pass array params as JSON-encoded strings
+    # Tolerate LLM providers that pass array params as JSON-encoded strings.
+    # Validate decoded shape: reject anything that isn't a list of strings.
     if isinstance(skills, str):
+        original_skills = skills
         try:
-            skills = json.loads(skills)
+            decoded_skills = json.loads(skills)
         except json.JSONDecodeError:
             skills = [s.strip() for s in skills.split(",") if s.strip()]
+        else:
+            if isinstance(decoded_skills, str):
+                skills = [decoded_skills]
+            elif isinstance(decoded_skills, list) and all(
+                isinstance(skill, str) for skill in decoded_skills
+            ):
+                skills = decoded_skills
+            else:
+                skills = [original_skills]
     requested = list(skills or [])
     err = validate_requested_skills(requested)
     if err: