Verified 2026-08-05 What was checked, and when — not a guarantee it is still true.

Writing skills that survive Cowork

Claude Cowork runs your skill in a sandbox with rules that differ from the Claude Code CLI in ways that will silently break an otherwise-correct skill. This site covers the seven failure modes that actually show up: wrong path forms, deliverables that vanish on delivery, delete calls that fail with a permission error, a shell that cannot see your environment, runtime detection that reports the wrong answer, plugin paths that resolve differently per consumer, and sub-agent assumptions that do not hold. Every claim is derived from shipped binaries and live sessions, and is stamped with the build it was checked against. Start with the contract page if you want the short version.

Pages

• The contract: every rule on one page
  This page is generated from the rules on every other page, in order, with no additional prose.
• Where should my skill write files, and which path forms work?
  Your skill's shell commands and its file tools operate on one shared scratch space, but they refer to it by two different path forms.
• Why did my skill's output never reach the user?
  Cowork runs in two different execution lanes, and they disagree about what 'delivering a file' means.
• Why does deleting a file fail, and what should my skill do?
  Every Cowork-mounted directory denies exactly two operations by default: removing a file and removing a directory.
• What does my skill's shell see?
  The shell your skill runs commands in is sealed: environment variables you set on the host do not reach it, and neither do exports written by hooks.
• How should my skill detect that it is running in Cowork?
  A naive environment-variable check false-negatives in exactly the configuration that matters most, because the part of your skill that runs shell commands runs somewhere with none of those markers set.
• Will my plugin's hooks and scripts run in Cowork?
  Yes — plugin hooks do fire in Cowork.
• What changes when my skill dispatches sub-agents?
  Sub-agents run under the same containment as the main thread — they are not a way to escape a path restriction or a permission prompt.
• What can change without any version bump?
  A large amount of Cowork's behaviour is served from the operator's side rather than shipped in the application, which means it can change with no new version, no release note, and no signal to your skill.
• What this was verified against
  Everything on this site was checked against the specific artifacts recorded here.