skilldrop 0.16.28

Released 2026-10-19 · npx skilldrop-cli@0.16.28

Contain what a skill can reach. skilldrop install <skill> --project --contain turns on Claude Code's strict sandbox for that project, sized to what the skills declare: shell commands, and everything they start, write only inside the project and reach only the hosts the skills say they need. It only ever tightens your settings, never loosens or widens them, keeps the file out of git, and refuses a skill that says it writes anywhere on disk. It also says plainly what the sandbox doesn't cover (Claude Code's file and web tools, MCP servers, hooks) and how to close that (RFC-0051, how-to).
A policy can require it. With "require_containment": true, an install that isn't contained is refused, and Claude Code won't start in a contained project if its sandbox can't. skilldrop inventory shows which projects are contained.