The skill grants broad file system access and inject
Claims to do
Opus 4.5 Migration Guide: One-shot migration from Sonnet 4.0, Sonnet 4.5, or Opus 4.1 to Opus 4.5.
Actually does
The skill instructs the AI to search a user's codebase for specific model strings (Sonnet 4.0/4.5, Opus 4.1) and API calls, then update them to Opus 4.5 model strings based on the platform. It also guides the AI to remove an unsupported beta header, add an 'effort' parameter, and conditionally adjust prompts based on user-reported issues by integrating snippets from internal reference files (`references/prompt-snippets.md`, `references/effort.md`).
/plugin marketplace add anthropics/claude-code/plugin install claude-opus-4-5-migration@anthropics/claude-codenpx skills add https://github.com/anthropics/claude-code --skill claude-opus-4-5-migrationThe skill is designed to search, read, and modify the user's codebase (e.g., update model strings, remove headers, add parameters). While this is the stated purpose, it grants significant file system access and modification capabilities to the agent, which could be abused if the skill's logic is compromised or extended beyond its intended scope.
Search codebase for model strings and API calls; Update model strings to Opus 4.5; Remove unsupported beta headers; Add effort parameter set to 'high'
The skill instructs the agent to read content from local reference files (e.g., `references/prompt-snippets.md`, `references/effort.md`) and inject it into user prompts or configurations. If these local files are not securely managed or can be tampered with, an attacker could inject malicious instructions or data into the agent's context or the user's codebase.
Add the snippet from `references/prompt-snippets.md`; See `references/prompt-snippets.md` for the full text of each snippet to add; See `references/effort.md` for configuring the effort parameter
[](https://mondoo.com/ai-agent-security/skills/github/anthropics/claude-code/claude-opus-4-5-migration)<a href="https://mondoo.com/ai-agent-security/skills/github/anthropics/claude-code/claude-opus-4-5-migration"><img src="https://mondoo.com/ai-agent-security/api/badge/github/anthropics/claude-code/claude-opus-4-5-migration.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/anthropics/claude-code/claude-opus-4-5-migration.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.