Permissions

The SDK restricts agent-generated code to explicitly exposed host functions, preventing access to application secrets, credentials, or the broader Node.js environment.

Claude Code's auto mode classifier denied the agent's command to terminate a malware process it had itself detected, illustrating how permission systems can block legitimate recovery actions.

A public skills repository implies a permission and trust model for which skills an agent can invoke in a given context.