Claude Code 2.1.275 syncs skills from claude.ai and blocks plugin scripts
Anthropic released Claude Code v2.1.275 on 17 September at 22:33 UTC. The release syncs skills and plugins enabled on a claude.ai account to any signed-in terminal session, adds a plugin install command that first offers to add the marketplace, and fetches plugins from npm with install scripts disabled.
Image: GitHub
Why it mattersThe plugin change removes a way that installing a marketplace plugin could run arbitrary code on a developer's machine, and the claude.ai sync means the set of skills a team uses in the browser is now available in the terminal without a second setup step.
Anthropic released Claude Code v2.1.275 on 17 September at 22:33 UTC. The changelog is one of the longer ones in the 2.1 series and it includes two changes that affect anyone using the CLI or the VS Code extension, plus a set of security fixes.
What is new for someone using it today
Terminal sessions signed in with a claude.ai account now receive the skills and plugins that account has enabled. Anthropic says the sync happens automatically, and a team that wants to opt out can set syncClaudeAiSkills: false or syncClaudeAiPlugins: false. That removes the gap where a skill added in the browser was not available in the terminal until a person set it up a second time.
A new keystroke, Ctrl+Enter (or Ctrl+X Ctrl+S), sends every queued message at once and interrupts the current turn. The changelog notes that sent and queued messages show in gray until the model receives them, so it is clear which messages made it through.
The plugin installer gained a --marketplace <source> flag: running /plugin install <plugin> --marketplace <source> now offers to add the marketplace before installing the plugin, so a marketplace and its first plugin can be added in one step instead of two.
The security-relevant changes
The most important one is a change to how plugins are fetched from npm. Anthropic writes that plugin installs from an npm source now run through npm pack --ignore-scripts and are integrity-verified, so a package's install scripts no longer run when Claude Code adds it as a plugin. Before this release, installing a marketplace plugin from npm meant running whatever lifecycle scripts that package included, on the developer's machine. That is now off by default.
Two other fixes belong in the same class: plugin and marketplace messages, logs, and claude plugin marketplace list used to show a password or token if one had been typed into a git, ssh, or marketplace URL, and now redact it. Sandboxed Bash commands on Linux running under zsh had been reporting exit code 0 for failed commands, which meant scripts that relied on exit codes ran the wrong branch without any warning.
The rest
The release also fixes a memory-file age note that was changing between requests and clearing the prompt cache after a compaction, several session-resume and transcript failures on malformed history entries, and one that made VS Code renaming of a running session revert to the generated name. A separate group of items covers Claude Tag, Anthropic's Slack integration, including new Amazon CloudWatch, SNS, Google Cloud Monitoring, and Datadog presets for its access-bundle credentials tab.
Source
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
