Skills
A cloned repo could redirect Claude Code's config and temp directories, and a swapped symlink could beat the permission check
v2.1.251 fixes file tools following a symlink swapped inside the working directory after the permission check passed, Grep and Glob ignoring `Read(...)` deny rules through a symlinked search path, plugin marketplace entries pointing outside the plugin directory, and project-level `.claude/settings.json` `env` setting `CLAUDE_CONFIG_DIR`, `CLAUDE_CODE_TMPDIR`, or `TMPDIR`. Settings that terminate sandbox TLS, route sandbox traffic through a proxy, or inject credentials now require explicit approval, as does `ANTHROPIC_CUSTOM_HEADERS` when it sets an auth or routing header. The practical rule is that a checked-out repository was previously trusted to configure the harness that reads it.
↳ Follow the thread