Quarantining Cloud-Synced "Convenience" on Your Own Machine — How Claude Code v2.1.228 Closed the Gaps in Synced-Skill Overreach and Remote-Resume Peeking

On August 11, Anthropic released Claude Code v2.1.228. There are no flashy new features, but the focus of this release is clear: it closes, all at once, the gaps that let "convenience coming in from somewhere else"—skills synced from the cloud, sessions resumed remotely, cleanup routines that run automatically—quietly cross boundaries to overreach their privileges, expose their contents, or delete things that should never be deleted. This is an update that matters most when you run agents unattended, so let's walk through it in order.

Treating skills synced from claude.ai as "quarantined" on your own machine

Claude Code lets you sync skills created on claude.ai down to your local machine. That's convenient, but when cloud-originated instructions run with the same trust as local tools, it can lead to unintended behavior or injected instructions. v2.1.228 stops treating synced skills as local first-class citizens and imposes the following restrictions.

• No name hijacking: a synced skill can no longer override (shadow) a local command or an MCP prompt. Even with the same name, your local definition takes precedence.
• Description sanitization and labeling: a skill's description is sanitized and displayed with a label that makes clear it was synced.
• Stripping the body of its power to execute: on your local machine, a synced skill's body will not run commands that begin with ! or expand files with @.

In short, the line drawn here is to treat instructions that arrive from outside as "raw material" rather than "a script you can run as-is." The fact that skills and plugins can become an entry point for intrusion via the very same path as their convenience is a point Anthropic has been addressing repeatedly over the past few weeks, and this release applies the same philosophy to the "sync" path.

A remotely resumed session was letting others peek at the previous conversation

With Remote Control (the feature that lets you connect from another machine to operate a session), running /resume while connected had a bug where the title and history of the resumed conversation leaked into the connecting session. v2.1.228 fixes this. For anyone working across local and remote, having another conversation's contents unintentionally displayed is an information leak—a subtle but not-to-be-overlooked kind of bug.

Along with this, cross-session message display was also improved. Instead of a collapsed single line showing the sender and body, messages now expand in place, and messages addressed to a Remote Control session on another machine now show your own Remote Control session name as the sender.

"Automatic cleanup" was touching things that should never be deleted

Several fixes also landed in the behind-the-scenes machinery that supports unattended operation. The two most relevant to data preservation are as follows.

• No more collateral deletion of the memory folder: fixed an issue where session cleanup would delete the contents of a project's memory folder as well.
• No more accidental deletion of the plugin cache: fixed an issue where, when the only version was a symlinked development checkout, background cache cleanup would delete that plugin's cache.

The stability of self-hosted runners (a setup where you run agents CI-style on your own machine) also improved. Previously, if one repository's checkout hook failed, the entire session would crash every time—over a repository it wasn't even going to push to. That was changed so it now skips the affected repository with a warning and continues. It also closed an issue where a session could end in the gap between a background task finishing and the next turn starting. In environments where agents run unattended, fixes that nip these "fails silently / deletes silently" problems in the bud translate directly into operational reliability.

Tightening on one front, loosening on another—the Write tool's "overwrite even if unread"

Amid all these boundary-tightening fixes, there's one change that actually loosened a guard. Previously, the Write tool could not overwrite a file that had never been read in the current session. v2.1.228 allows overwriting unread files—but only for newer models, bringing it in line with the same rule as the Edit tool (older models still require reading the file first).

Workflow friction is reduced, but the safety valve of "always read the current state before overwriting" also served to prevent unintended full overwrites. If you've built deep automation, it's reassuring to keep your own procedure for verifying that the overwrite target is what you expect. It's worth keeping in the back of your mind that this is a change that lowers the default level of caution by one notch in the name of convenience.

What operators should do

Here's how to put this into practice.

• Update and take stock of your synced skills: after upgrading to v2.1.228, review the list of skills you're syncing from claude.ai and check that the labeling and behavior are as expected.
• Revisit remote operation: if you use Remote Control across multiple machines, keep in mind that before the update conversations could get mixed up via /resume, and inspect any sessions that handled sensitive content.
• Re-check unattended jobs: if you've built self-hosted runners or background tasks, check your logs for the spots where this round's stabilization changes behavior (such as skipping on hook failure).
• Watch out for Write overwrites: if you're automating with newer models, work on the assumption that overwrites of unread files can happen, and insert a step to verify the target file.

v2.1.228 is not a release that adds features—it's a release that inspects the "entrances to convenience" one by one and redraws the lines. The more you run agents unattended, the more this kind of boundary design directly determines the scale of your operational risk.

References: Claude Code changelog (official) / anthropics/claude-code CHANGELOG.md / Releasebot: Claude Code Updates