Skip to main content

​
What this is for

When your organization blocks a skill in the AI Control skill catalog, Claude Code denies it on every enrolled machine. Other AI tools (Antigravity, Gemini CLI, Codex, Copilot, Windsurf) load skills from their own folders and have no such check. Skill custody closes that gap: on managed machines, the agent moves the blocked skill’s folder out of every tool’s skill directory and leaves a short notice in its place, so no AI tool on the machine can load it. Custody never deletes anything. When the block is lifted, or custody is turned off, the skill goes back exactly where it was, owned by the same person.

​
Options

Custody acts on a machine only when all four of these are true: Block skills in every AI tool can only turn custody on. It never turns it off on a machine where an administrator turned it on locally. Changes reach machines at their next policy refresh, with no restart.

​
How to configure

1

Block the skill

Add the skill to the blocked list in the AI Control skill catalog, and set skill lockdown to enforce.
2

Turn on custody in the Detection Policy

Open the Detection Policy that covers the machines, go to Live guard, and turn on Block skills in every AI tool. Publish the policy.
3

Check the endpoints

Open an endpoint and go to Skills & findings. The custody panel shows whether blocked skills are held on that machine.
Roll out to a pilot group first. Before you turn custody on, the panel already counts blocked skills it would hold, so you can see the blast radius without moving a file.

​
What the console shows

The panel on Skills & findings says whether custody is enforcing on that machine and, when it is not, the first thing to change: When custody is on, the panel also says who turned it on: Turned on by policy or Turned on locally on this machine. Each blocked skill carries a chip: Watching means the machine reacts to a new blocked skill within seconds. Watching, partial means some skill folders could not be watched and rely on the regular rescan every few minutes. A Partial coverage box lists skill folders the agent could not read at all.

​
When custody refuses to act

Custody never follows a folder shortcut (symlink) it did not create. If a developer’s skill folder, or any folder between their home and it, is a symlink, custody refuses to act there. The most common case is ~/.claude linked into a dotfiles repository. The skill stays usable in every tool, and the console shows Custody failed for it instead of reporting it as held. To cover that developer, have them use a real folder for the tool’s skills, or remove the skill from the dotfiles repository it comes from.

​
Removing the agent

Uninstalling the agent gives every held skill back before anything is removed. If a skill cannot go back, the uninstaller keeps the agent’s data folder and prints where the skill is held. Do not delete the agent’s data folder by hand to clean up: that folder is where held skills live. See Uninstall & Recovery.
A small notice file named .guardway-tombstone inside a skill folder is custody’s notice. Do not delete it by hand: the skill is held by the agent, and the notice is how it gets back.

​
Limits

  • Custody covers the skill folders of the AI tools the agent knows about. A tool that loads skills from somewhere else is detected but not covered.
  • Skills inside code repositories are reported as Not moved and never moved.
  • Custody acts on managed machines only.