SKM-P02 · Portability
`allowed-tools` is experimental
The specification marks `allowed-tools` experimental, with support that 'may vary between agent implementations.' Don't treat it as a security control.
What the rule is
`allowed-tools` is a space-separated list of pre-approved tools, and it's in the specification — but the specification itself marks it experimental, stating that support 'may vary between agent implementations.' No runtime's documentation commits to consistent behaviour for it.
It's also the field people reach for first when they want to constrain what a skill can do, which makes its unevenness the most consequential caveat in the format for anyone building a trust or safety model around skills.
Where it comes from
- Agent Skills — SpecificationSpecification / reference validator
- skills-ref validate (official reference validator, v0.1.5)Specification / reference validator
- Agent Skills compatibilityAgentSkills.site
Strict spec conformance
Conformant. The official reference validator (skills-ref) accepts this.
This is a separate question from the severity above and from which runtimes enforce it below — a rule can be a real, working extension in its home runtime while the reference validator still rejects the file outright, or vice versa. Both facts are reported, never one inferred from the other.
Which runtimes enforce it
| Runtime | Effect | Note |
|---|---|---|
| Claude Code | Not documented | In the spec, but the spec itself does not commit to consistent behaviour across implementations — that caveat is the finding. |
| Codex | Not documented | In the spec, but the spec itself does not commit to consistent behaviour across implementations — that caveat is the finding. |
| Cursor | Not documented | In the spec, but the spec itself does not commit to consistent behaviour across implementations — that caveat is the finding. |
| OpenClaw | Not documented | In the spec, but the spec itself does not commit to consistent behaviour across implementations — that caveat is the finding. |
| Hermes Agent | Not documented | In the spec, but the spec itself does not commit to consistent behaviour across implementations — that caveat is the finding. |
How to fix it
- Don't rely on `allowed-tools` as a security or safety control. If tool access genuinely needs to be constrained, do it at the runtime or MCP-server level instead, where the guarantee is real.
Elsewhere
- SKILL.md, the formatThe full frontmatter field table this rule is drawn from.
- Agent Skills Not WorkingThe diagnostic reference this rule’s portability and failure evidence comes from.
- All rulesEvery check the validator runs, grouped by class.