Claude Agent SDK 0.2.129 patches an --allowedTools injection where a crafted skill name could grant itself extra permissions
Shipped 2026-08-04, the Python Claude Agent SDK fixed a flaw where skill names passed via `ClaudeAgentOptions(skills=[...])` went unchecked into the CLI's `--allowedTools` value, which splits on commas and spaces, so a name carrying those delimiters could inject additional permission rules into the agent's own sandbox policy. The transport now validates each name and raises `ValueError` at connect time for parentheses, commas, control characters, wildcards, leading slashes, surrounding whitespace, or surrogate code points, which is a breaking change: `skills=["*"]` and `skills=["plugin:*"]` must become `skills="all"` or an explicit `Skill(...)` rule. Names with leading whitespace or a leading slash previously built rules that could never match, silently disabling the skill rather than failing loudly.
↳ Follow the thread