Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.227 Home All releases ←olderv2.1.226 v2.1.228newer→
Claude Code v2.1.227

Skills sync now refuses damaged or hostile skill packages

You'll notice
Useful3 Signal3
Skills

Skill syncing now rejects broken or repo-shaped skill archives and repairs a symlinked skills folder.

What

The background sync that installs skills was reworked to survive bad downloads and crashed runs. A downloaded skill archive is rejected if it has no usable SKILL.md or if it looks like a git repository, and if the folder skills sync into turns out to be a symlink it is deleted and recreated.

Details
  • New log entries: skills_sync_extracted_zip_unusable for a rejected archive, skills_sync_root_symlink_removed for the symlinked root, and a hard error "synced skills root is not a directory" if it cannot be made one.
  • Directories that cannot be deleted are moved to a trash directory instead of blocking the sync.
  • The record of installed skills gained lists of stale directories and pending claims; a claim carries the owning process id and its start time, so a half-installed directory left by a crashed run is reclaimed by the next one.
  • An older record layout is migrated or repaired at startup, logged as skills_sync_legacy_layout_migrated and skills_sync_legacy_manifest_repaired.
Evidence

skills_sync_extracted_zip_unusable

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.227 →