What
The same caution now covers plugin commands. A command's allowed-tools field lists tools it may use without asking you. For a command from a plugin (an add-on package), Claude Code now leaves that list empty and shows a warning when the entries:
- are too long
- name a folder that holds a variable or a
$
The warning says its allowed-tools "are not filled in". Claude Code also now keeps a plugin command's or skill's frontmatter (the settings block at the top of its file) exactly as written, alongside the version it reads.
Why
A malformed plugin command can no longer end up allowed to use the wrong tools.
Names in the bundleallowed-tools
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up allowed-tools, on Choose a permission mode.
* **[Add allow rules](/docs/en/permissions#manage-permissions)**: Claude runs the calls you list. Pass [`--allowedTools "Bash(npm test)"`](/docs/en/headless#auto-approve-tools) to `claude -p`, or set your SDK's [allowed-tools option](/docs…permission-modes see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up allowed-tools, on Choose a permission mode.