Verified 2026-08-05 What was checked, and when — not a guarantee it is still true.
The shell your skill runs commands in is sealed: environment variables you set on the host do not reach it, and neither do exports written by hooks. The inline shell-execution syntax some skills use in their instructions is disabled in Cowork entirely. The shell tool is also not the same tool as the CLI's, so branching on tool names is a reliable signal where branching on environment variables is not.
From binary Can change without a version bump
The syntax that lets a skill embed a command in its own instructions and have the result substituted is disabled in Cowork. It fails quietly rather than erroring, so a skill that relies on it to gather context gets an empty result and carries on with wrong assumptions.
Caveat: Controlled by a setting rather than hardcoded, so the behaviour is configuration-dependent.
From binary Can change without a version bump
Fetching over the network happens through a dedicated capability with its own routing and allow rules, not through unrestricted sockets from the shell. Write skills that use the fetch capability when it exists and state a clear limitation when it does not, rather than shelling out to a network client and assuming it works.
Caveat: Routing for fetching has changed across releases and is configuration-dependent.
Inference Can change without a version bump
Outbound network access is constrained, so a skill whose first step is a package install will fail or hang in a way that looks like a bug in your skill. Use what is present, vendor what is small, and state the limitation when neither is possible.
Caveat: Follows from the egress constraints rather than a direct install attempt; routing is configuration-dependent.
The environment your shell commands run in comes with a substantial set of Python packages already installed — data, document, and imaging libraries among them. Skills have shipped workarounds and portability warnings for a scarcity that is not there. Check for what you need before vendoring it or degrading.
Caveat: Read from the shipped guest image; the exact package set is a property of that image and can change with it.
Each session runs as its own operating-system user with its own identity, and other sessions' data is not readable even though the machine may be shared. Anything your skill needs must be inside the session or fetched into it.
Caveat: Verified by attempting cross-session reads, which were refused.
The shell your skill's commands run in does not inherit the host environment. Variables set in user or managed settings do not appear, and neither do exports written by hooks. Configuration has to travel in the command itself, in a file the skill writes, or through a mechanism designed to cross that boundary.
Caveat: Established by a live probe rather than from the binary; the symbol that once documented the boundary has since disappeared from the shipped application.
The tool your skill uses to run commands in Cowork is a different tool from the CLI's, with a different name. This matters if your skill's instructions name tools explicitly, and it is also useful: the tool surface is a more reliable indicator of where you are running than the environment is.