{"version":"2.1.248","anchor":"command-and-skill-names-are-escaped-everywhere-they-are-echo","canonical_anchor":"command-and-skill-names-are-escaped-everywhere-they-are-echo","heading":"Command and skill names are escaped everywhere they are echoed back","tier":"notice","area":"Slash Commands","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.248\/e\/command-and-skill-names-are-escaped-everywhere-they-are-echo","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.248","markdown":"### Command and skill names are escaped everywhere they are echoed back\n\nCommand and skill names from plugins or MCP servers are escaped everywhere, always on.\n\n**What**\n\nSlash command and skill names now go through a single escaping helper wherever they appear in text that reaches the model or your terminal, so a name supplied by a plugin or MCP server cannot inject markup, control characters or instructions. This is always on, with no flag or setting to disable it.\n\n**Details**\n\n- Applies to unknown-command errors, the refusal \"This skill can only be invoked by Claude, not directly by users.\", and the coordinator-mode skill refusal along with the subcommand and allowed-tools lists it prints.\n- Warnings for a stacked slash command that is blocked or fails to load are escaped too, including the message \"Stacked skill \/${St(k.name)} blocked by UserPromptExpansion hook\".\n- Failures in JSX-based local commands render their stderr through a formatter given the command name and session, instead of dumping the raw thrown value.\n\n**Evidence**\n\n`Stacked skill \/${St(k.name)} blocked by UserPromptExpansion hook`, `This skill can only be invoked by Claude, not directly by users. Ask Claude to use the \"`\n\n- Area: Slash Commands\n- Tier: You'll notice\n- Useful: 4\/5\n- Signal: 3\/5"}