Claude Code’s Local Skills: Speed vs Security

Claude Code’s Local Skills: Speed vs Security

We break down Claude Code v2.1.157’s local .claude/skills workflow, where executable scripts can be loaded straight from a developer’s machine for instant tool creation and hot reloading. The conversation also digs into the security risks of committing custom plugins to source control, including the possibility of arbitrary code execution.

Claude Code Adds Auto-Fix and Simplify Cleanup

We dig into Claude Code’s new /code-review --fix workflow, which can edit files directly instead of just leaving comments, and the revamped /simplify pass for trimming dead code and redundant structure. The episode also covers safer usage tips, from keeping a clean git tree to reviewing diffs, plus the new skipLfs option for speeding up large repos.

Claude Code 2.1.153 Fixes Gateway Leak and Tightens MCP

We break down a critical credential leak in custom API gateways, where Claude Code mistakenly sent primary Anthropic OAuth credentials to the wrong place. The episode also covers faster git and GitHub plugin loading with skipLfs, plus new safeguards for subagent MCP configs to prevent privilege escalation.

Claude Code Fixes a 10GB MCP Leak and a Sneaky Resume Bug

This episode digs into the v2.1.132 Claude Code update, including a stdio MCP memory leak that could balloon long sessions past 10GB, plus the practical differences between stdio and HTTP transport. It also covers new session-aware Bash env vars, a terminal escape hatch for alternate screen mode, and a permission-mode bug that could quietly override your intent when resuming plan-mode sessions.

Claude Code 2.1.129 Turns Plugins Into Shareable Artifacts

This episode breaks down how Claude Code v2.1.129 changes plugin loading with URL-based zip installs, moving plugins from local setup to a true distribution model. It also explores the new experimental themes and monitors fields, and the security tradeoffs that come with treating plugins like packaged software.