Skills you did not install - claude.ai sync arrived in 2.1.275Capability

Claude Code 2.1.275 started syncing the skills and plugins enabled on your claude.ai account into terminal sessions. Check what arrived, and opt out if it is not yours.

Every skill loaded into a session costs tokens on every turn, whether or not it fires. That is why the roster is curated and why the skill-addition rule says read the SKILL.md and scripts first. Since 2.1.275, signing in with a Claude account also pulls in whatever skills and plugins are enabled on claude.ai - a second source of context you did not choose at the terminal.

Two settings switch it off: syncClaudeAiSkills: false and syncClaudeAiPlugins: false in ~/.claude/settings.json. Edits to a synced skill are not saved back to the account; the tool result says so. The ListPlugins tool lists account plugins, not the ones installed with /plugin.

Two other lines in this window touch your headless jobs. 2.1.277: claude -p sessions that could hang with no result after an internal error now report the error and exit 1 - the watchdog wrappers already treat a non-zero exit as failure, so this turns a silent hang into a logged one. Also 2.1.277: headless start-up no longer waits on the per-directory CLAUDE.md lookup. 2.1.274 fixed claude agents losing --model and --effort after an auto-update relaunch.

Worked example

Compare what a session sees with what is on disk, then opt out.

claude --version
ls ~/.claude/skills | grep -v _shelved | wc -l
# inside a session:  /skills

# opt out (merge into the existing JSON, do not replace it)
python3 - <<'PY'
import json,pathlib
p=pathlib.Path.home()/'.claude/settings.json'; d=json.loads(p.read_text())
d['syncClaudeAiSkills']=False; d['syncClaudeAiPlugins']=False
p.write_text(json.dumps(d,indent=2)+'\n'); print('written')
PY

• 2.1.276 today. claude update takes you to 2.1.278.
• Local skill count. Anything /skills shows beyond this list came from the account sync.
• Adds the two keys and leaves every other setting untouched.

Gotchas

• Skills synced from the account move to a recoverable trash if the organization turns Skills off (2.1.273); they do not vanish.
• npm-sourced plugins now install with --ignore-scripts (2.1.275) - a security win, but a plugin that needs a build step may need a manual step.