Finding / flue
2026-10-13-flue-the-allowed-tools-correction-shipped-in-2-1-1-the-field-is-still-unenforced
The allowed-tools correction shipped in 2.1.1; the field is still unenforced. The docs and the type comment now match the behavior: a skill’s allowed-tools lists what its author expects to use and restricts nothing. The fix has left main and is in a release.
Channel: tagged-release (it was main-unreleased when the parent harvest closed). Half: defect. Date: 2026-09-23.
Operator consequence: Behavior did not change, so the earlier re-audit still applies. Any restriction a skill relied on has to live in tool code or an approval gate (section 11).
Receipt
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-flue-the-allowed-tools-correction-shipped-in-2-1-1-the-field-is-still-unenforced
Source links
Primary links, including exact changelog lines when available.
- github release2026-10-13-flue-the-allowed-tools-correction-shipped-in-2-1-1-the-field-is-still-unenforcedwithastro/flue / %40flue/runtime%402.1.1tagged commit file2026-10-13-flue-the-allowed-tools-correction-shipped-in-2-1-1-the-field-is-still-unenforcedwithastro/flue / packages/runtime/src/types.ts#L214-L219tagged commit file2026-10-13-flue-the-allowed-tools-correction-shipped-in-2-1-1-the-field-is-still-unenforcedwithastro/flue / apps/docs/src/content/docs/guide/skills.md#L58-L60