AI coding tools
Claude Code 2.1.261 Exposes Skills’ Context Costs and Tightens Data Exfiltration Rules in Auto Mode
The new `/skill-doctor` command lists unused skills and their context footprint, helping developers identify prompt costs paid repeatedly on every turn. The update also expands dangerous deletion detection, fixes context loss during session restoration, and treats public chart URLs containing embedded content as external uploads.
Anthropic released Claude Code 2.1.261 on September 4, focusing not on a model change but on improving observability and security boundaries in the agent execution environment. The new `/skill-doctor` command displays each loaded skill’s source, fixed context cost, seven-day token usage, invocation count, and last-used time. Although a skill’s full instructions are typically loaded only when it is actually invoked, its name and summary are still included in the system prompt on every turn. In the environment tested by the article, which had 124 skills installed, 84 had never been used and together consumed approximately 8,230 tokens per turn. However, this represents only a single environment, and `never` may simply indicate that a skill was recently installed or is used infrequently, so the results should not be treated as a ready-made removal list.
Two new settings, `bashOutputMaxChars` and `taskOutputMaxChars`, can raise the output limit sent directly to the model from commands and background tasks to 128K characters, with only the excess stored in a file. This helps with analyzing long logs, but it also increases context usage and cost. Meanwhile, `--append-subagent-system-prompt-file` allows longer subagent system prompts to be injected from a file, making it suitable for version-controlled team policies.
On the security front, dangerous `rm` confirmation can now recognize positional arguments and `rm -rf` commands inside double-quoted `sh -c` strings, though it remains a warning rather than an enforced sandbox. Auto mode also no longer allows public charting services that encode content in URLs by default, because doing so effectively sends data to a third party. The release also fixes hook output near parallel tool calls being lost when sessions are restored, high CPU usage caused by background agent retries, and team agents resending declarations in ways that invalidate the prompt cache. After upgrading, engineering teams should retest keybinding configurations, managed sign-in policies, and automated approval workflows. `keybindingFlavor` no longer affects certain word-editing keys, and machines configured for fixed gateway authentication will ignore any residual API key.