diff --git a/README.md b/README.md
index ebdd9a7..f2f91b1 100644
--- a/README.md
+++ b/README.md
@@ -54,11 +54,11 @@ Skills compose by adoption-list order (`10123`) and trigger tags carry runtime e
 
 Didactyl will support local inference, which is very privacy preserving. Remote inference does however have it's advantages, and in those cases Didactyl supports using Bitcoin Lightning and eCash inference providers.
 
-## Current Status — v0.2.35
+## Current Status — v0.2.36
 
 **Active build — this project is barely working. Experiment at your own risk.**
 
-> Last release update: v0.2.35 — Remove top-level dm_protocol from genesis configs and set user-settings kind 30078 dm_protocol to both
+> Last release update: v0.2.36 — Block model_get/model_set/model_list inside skill_run with explicit policy gate
 
 - Connects to configured relays with auto-reconnect and relay state transition logging
 - Publishes configured startup events per relay as each relay becomes connected
diff --git a/src/main.h b/src/main.h
index 86fda2e..dbbe08c 100644
--- a/src/main.h
+++ b/src/main.h
@@ -12,8 +12,8 @@
 // Using DIDACTYL_ prefix to avoid conflicts with nostr_core_lib VERSION macros
 #define DIDACTYL_VERSION_MAJOR 0
 #define DIDACTYL_VERSION_MINOR 2
-#define DIDACTYL_VERSION_PATCH 35
-#define DIDACTYL_VERSION "v0.2.35"
+#define DIDACTYL_VERSION_PATCH 36
+#define DIDACTYL_VERSION "v0.2.36"
 
 // Agent metadata
 #define DIDACTYL_NAME "Didactyl"
diff --git a/src/tools/tool_skill.c b/src/tools/tool_skill.c
index 3ce4c41..8efafad 100644
--- a/src/tools/tool_skill.c
+++ b/src/tools/tool_skill.c
@@ -606,6 +606,21 @@ static int maybe_append_loaded_skill_instructions_local(cJSON* messages,
     return rc;
 }
 
+static int is_tool_blocked_in_skill_run_local(const char* tool_name) {
+    if (!tool_name || tool_name[0] == '\0') return 1;
+
+    static const char* blocked_tools[] = {
+        "model_get", "model_set", "model_list",
+        NULL
+    };
+
+    for (int i = 0; blocked_tools[i] != NULL; i++) {
+        if (strcmp(tool_name, blocked_tools[i]) == 0) return 1;
+    }
+
+    return 0;
+}
+
 static int is_tool_sandbox_safe_local(const char* tool_name) {
     if (!tool_name || tool_name[0] == '\0') return 0;
 
@@ -2283,7 +2298,9 @@ char* execute_skill_run(tools_context_t* ctx, const char* args_json) {
             llm_tool_call_t* tc = &resp.tool_calls[i];
             char* tool_result = NULL;
 
-            if (sandbox_enabled && !is_tool_sandbox_safe_local(tc->name)) {
+            if (is_tool_blocked_in_skill_run_local(tc->name)) {
+                tool_result = strdup("{\"success\":false,\"error\":\"tool blocked by skill_run policy\"}");
+            } else if (sandbox_enabled && !is_tool_sandbox_safe_local(tc->name)) {
                 tool_result = strdup("{\"success\":false,\"error\":\"tool blocked by skill_run sandbox\"}");
             } else {
                 tool_result = tools_execute(ctx, tc->name, tc->arguments_json);