SKM-P02 · Portability
`allowed-tools` is experimental
The specification marks `allowed-tools` experimental, with support that 'may vary between agent implementations.' Don't treat it as a security control.
What the rule is
`allowed-tools` is a space-separated list of pre-approved tools, and it's in the specification — but the specification itself marks it experimental, stating that support 'may vary between agent implementations.' No runtime's documentation commits to consistent behaviour for it.
It's also the field people reach for first when they want to constrain what a skill can do, which makes its unevenness the most consequential caveat in the format for anyone building a trust or safety model around skills.
Where it comes from
- Agent Skills — SpecificationSpecification
- Agent Skills compatibilityRuntime documentation
Which runtimes enforce it
| Runtime | Effect | Note |
|---|---|---|
| Claude Code | Not documented | In the spec, but the spec itself does not commit to consistent behaviour across implementations — that caveat is the finding. |
| Codex | Not documented | In the spec, but the spec itself does not commit to consistent behaviour across implementations — that caveat is the finding. |
| Cursor | Not documented | In the spec, but the spec itself does not commit to consistent behaviour across implementations — that caveat is the finding. |
| OpenClaw | Not documented | In the spec, but the spec itself does not commit to consistent behaviour across implementations — that caveat is the finding. |
| Hermes Agent | Not documented | In the spec, but the spec itself does not commit to consistent behaviour across implementations — that caveat is the finding. |
How to fix it
- Don't rely on `allowed-tools` as a security or safety control. If tool access genuinely needs to be constrained, do it at the runtime or MCP-server level instead, where the guarantee is real.
Elsewhere
- SKILL.md, the formatThe full frontmatter field table this rule is drawn from.
- Agent Skills Not WorkingThe diagnostic reference this rule’s portability and failure evidence comes from.
- All rulesEvery check the validator runs, grouped by class.