What
Slash command and skill names now go through a single escaping helper wherever they appear in text that reaches the model or your terminal, so a name supplied by a plugin or MCP server cannot inject markup, control characters or instructions. This is always on, with no flag or setting to disable it.
Details
- Applies to unknown-command errors, the refusal "This skill can only be invoked by Claude, not directly by users.", and the coordinator-mode skill refusal along with the subcommand and allowed-tools lists it prints.
- Warnings for a stacked slash command that is blocked or fails to load are escaped too, including the message "Stacked skill /${St(k.name)} blocked by UserPromptExpansion hook".
- Failures in JSX-based local commands render their stderr through a formatter given the command name and session, instead of dumping the raw thrown value.
Evidence
Stacked skill /${St(k.name)} blocked by UserPromptExpansion hook, This skill can only be invoked by Claude, not directly by users. Ask Claude to use the "
Strings lifted out of the shipped bundle, so the claim above can be checked against them.