--- title: "Claude Code v2.1.225–228: Skill Sandboxing Tightens Days Before Auto Mode Goes Default" date: 2026-08-12 tags: ["claude-code","changelog","security","auto-mode","skills"] categories: ["AI Tools"] summary: "Four releases between August 8-11 close the gap on last week's v2.1.224: v2.1.228 hardens skills synced from claude.ai so they can no longer shadow local commands or run shell commands on your machine, while a quieter one-line change removes the auto-mode cost notice for Pro, Max, and Team — two days before auto mode becomes the default permission mode on August 14." --- ![Claude Code v2.1.225–228: Skill Sandboxing Tightens Days Before Auto Mode Goes Default](/images/claude-code-v2-1-225-228-skill-hardening-self-hosted-fixes.png) Last week's [v2.1.224](/posts/claude-code-v2-1-224-cross-session-messaging/) shipped cross-session messaging and self-hosted runners the same week three straight releases hardened permission and sandbox boundaries. Four more releases have landed since — v2.1.225 (Aug 8), v2.1.226 (Aug 8, reliability-only), v2.1.227 (Aug 10), and v2.1.228 (Aug 11) — verified directly against [Anthropic's own changelog](https://code.claude.com/docs/en/changelog). Most of the run is routine bug-fixing on the infrastructure v2.1.224 just introduced. Two changes stand out, and they point in the same direction as last week's release: security tightening around new coordination surfaces, timed just ahead of a default-behavior change that puts more Claude Code sessions on autopilot. ## Skills Synced From claude.ai Get Sandboxed The headline fix in v2.1.228 addresses a gap in how skills — the reusable instruction packages Claude Code and claude.ai both support — behave once they cross from claude.ai into a local session. Per the changelog, skills synced from claude.ai: - **Can no longer shadow local commands or MCP prompts.** Previously, a synced skill with the same name as a command you'd defined locally, or an MCP server's prompt, could silently take precedence — meaning a skill you didn't author yourself could intercept an invocation you expected to route somewhere else. - **Have sanitized, labeled descriptions.** The skill's self-reported description — the text Claude reads to decide whether to invoke it — is now cleaned up and marked with its claude.ai origin, rather than trusted verbatim alongside locally authored skill descriptions. - **Can't run `!` shell commands or expand `@` file references on your machine.** A skill written in the claude.ai web interface, with no visibility into what's on your filesystem, previously had the same execution primitives as a skill you wrote and reviewed yourself. That's now cut off specifically for synced skills. This is a narrower, more specific fix than last week's sandbox deny-rule and credential-masking work, but it's the same category of problem: a feature designed for convenience — skills that follow you from the browser into the terminal — created an execution surface that didn't distinguish between "I wrote this and can see the whole thing" and "this arrived from somewhere else." Anthropic's [own skills documentation](https://code.claude.com/docs/en/skills) has always framed skills as something to author or vet carefully; a skill that can quietly appear in a local session via sync, take priority over a name you'd already claimed, and run shell commands, was a gap in that model until this release. ## A One-Line Change With a Two-Day Countdown Buried in v2.1.228's list of removals: "the outdated note about auto mode sessions costing slightly more" is gone from the first-use notice for Pro, Max, and Team plans. On its own that's a cosmetic cleanup. In context, it's the last piece of scaffolding coming down before [auto mode becomes the default permission mode](/posts/claude-code-auto-mode-default-pro-max-team/) for new sessions on those same three plans, effective August 14 — three days after this release. A cost caveat made sense when auto mode was an opt-in mode competing against a free default; it doesn't make sense once auto mode *is* the default, and Anthropic cleaned it up on schedule rather than leaving stale copy in the product past the cutover. It's a small detail, but it's consistent with how deliberately Anthropic has staged this rollout — this blog has now tracked the sequence from ["research preview, kept on a leash"](/posts/claude-code-auto-mode-anthropic-hands-ai-more-control/) in March, through a press correction in July, through the August 7 default announcement, down to a one-line notice cleanup landing exactly inside the pre-rollout window. Whatever else is true about the underlying safety numbers Anthropic published, the shipping cadence around the switch itself hasn't been sloppy. ## The Rest of the Run - **v2.1.225 (Aug 8)** added gateway spend-limit support to usage warnings (the limit-reached message now names the cap, reset time, and operator message), a workspace-trust prompt for `claude agents` in untrusted directories matching existing `claude` behavior, and a fix so auto mode no longer counts its own safety-filter refusals toward the consecutive-block limit — the action still gets denied, but the model is told to move on instead of retrying into a lockout. It also fixed a real reliability bug in the self-hosted runners v2.1.224 just introduced: sessions were registering and then failing outright when `--base-dir` couldn't be created, now caught at startup with a clear error instead of failing silently later. - **v2.1.226 (Aug 8)** — bug fixes and reliability improvements only, no changelog detail given. - **v2.1.227 (Aug 10)** fixed a bug where an expired login token could cause feature-flag evaluation to skip the user's actual subscription tier, wrongly prompting Max plan users to enable usage credits for Fable, plus a `claude-code-action` bug that broke every Bash command on GitHub-hosted runners under `allowed_non_write_users`. - **v2.1.228 (Aug 11)** also fixed cross-session messaging starting without an inbox on a session's first run post-install, a settings-merge bug where a marketplace entry could inherit another tier's custom headers, and changed the Write tool so newer models can now overwrite a file they haven't read this session — matching the rule Edit already followed, with older models still required to read first. ## The Pattern Holds Three releases in a row now — v2.1.221 through v2.1.223 closing sandbox and permission gaps, v2.1.224 shipping fleet-coordination primitives, and this run tightening the newest surface (synced skills) those primitives touch — Anthropic has been fixing the security model for a feature roughly as fast as it ships the feature itself. The self-hosted runner reliability fixes in v2.1.225 fit the same story: infrastructure that shipped last week getting its rough edges sanded down within days rather than left for users to discover. None of this is a substitute for independent verification of the bigger claims this blog has flagged elsewhere — the auto mode safety numbers, the still-overdue [PyPI incident transcript](/posts/anthropic-claude-models-breached-three-companies-cybersecurity-evals/) — but the changelog itself, read release by release, keeps showing the same discipline: ship the capability, then close the gap it opens, on a timescale measured in days, not months. Source: [Claude Code changelog](https://code.claude.com/docs/en/changelog), fetched directly, August 12, 2026 (covering v2.1.225 through v2.1.228, August 8-11).