The skill has extensive read/write access to
Claims to do
Opus 4.5 Migration Guide: One-shot migration from Sonnet 4.0, Sonnet 4.5, or Opus 4.1 to Opus 4.5.
Actually does
This skill provides a detailed guide for an AI to perform a migration from older Claude models to Opus 4.5. It instructs the AI to identify and update model strings in a codebase, remove a specific beta header, and add an 'effort' parameter. Additionally, it outlines conditional prompt adjustments based on user-reported issues, referencing internal `references/effort.md` and `references/prompt-snippets.md` for details.
/plugin marketplace add anthropics/claude-code/plugin install claude-opus-4-5-migration@anthropics/claude-codenpx skills add https://github.com/anthropics/claude-code --skill claude-opus-4-5-migrationThe skill is designed to directly modify user codebases by updating model strings, removing headers, and adding code snippets. This grants the agent significant write access to the user's file system, posing a risk if the agent's instructions are compromised or misused.
1. Update model strings to Opus 4.5 3. Remove unsupported beta headers 4. Add effort parameter set to "high" Add the snippet from `references/prompt-snippets.md`.
The skill requires the ability to 'Search codebase' to identify relevant files and patterns. This implies extensive read access to the user's entire codebase, which could be exploited for reconnaissance or unauthorized data exfiltration if the agent's behavior is manipulated.
1. Search codebase for model strings and API calls
The skill relies on internal Markdown files (`references/effort.md`, `references/prompt-snippets.md`) for critical instructions and content to be inserted into user prompts. If these internal references were sourced from an untrusted supply chain or dynamically loaded, they could be poisoned to inject malicious instructions or data.
See `references/prompt-snippets.md` for the full text of each snippet to add. See `references/effort.md` for configuring the effort parameter (only if user requests it).
[](https://mondoo.com/ai-agent-security/skills/github/anthropics/claude-code/claude-opus-4-5-migration)<a href="https://mondoo.com/ai-agent-security/skills/github/anthropics/claude-code/claude-opus-4-5-migration"><img src="https://mondoo.com/ai-agent-security/api/badge/github/anthropics/claude-code/claude-opus-4-5-migration.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/anthropics/claude-code/claude-opus-4-5-migration.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.