Command and skill names from plugins or MCP servers are escaped everywhere, always on.
What's wrong with this entry?
Slash command and skill names now go through a single escaping helper wherever they appear in text that reaches the model or your terminal, so a name supplied by a plugin or MCP server cannot inject markup, control characters or instructions. This is always on, with no flag or setting to disable it.
- Applies to unknown-command errors, the refusal "This skill can only be invoked by Claude, not directly by users.", and the coordinator-mode skill refusal along with the subcommand and allowed-tools lists it prints.
- Warnings for a stacked slash command that is blocked or fails to load are escaped too, including the message "Stacked skill /${St(k.name)} blocked by UserPromptExpansion hook".
- Failures in JSX-based local commands render their stderr through a formatter given the command name and session, instead of dumping the raw thrown value.
Stacked skill /${St(k.name)} blocked by UserPromptExpansion hook, This skill can only be invoked by Claude, not directly by users. Ask Claude to use the "
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.234
A crashing slash command now tells you it crashed
Both mention slash command
-
v2.1.234
A command can decide from its arguments whether it counts as sensitive
Both mention slash command
-
v2.1.234
A slash-command grouping for a command that does not exist
Both mention slash command