Open the capabilities tab
- Go to Agents and click the gear icon on an agent.
- Open the Capabilities tab.
- You will see secure mode, skills, tools, shell commands, and file paths.
Secure mode
Toggle secure mode for a locked-down profile: read-only shell, workspace-only files, no network, browser, web, apps, notify, or skills. Nothing can loosen it via a prompt.
Skills
Skills are instruction sets injected per task. Toggle the ones the agent may use. The catalog syncs from the device, so what you see is what the client actually supports.
Tools
Toggle individual tools: shell, files, web, browser, apps, notify, and more. Disabling a tool removes it from the agent entirely.
Shell commands and paths
- Add extra commands one per line (mkdir, cp, mv, python3).
- Or use
*to allow everything. - Add allowed file paths outside the workspace.
- Save capabilities.
The local policy still wins
i
Whatever you allow here, the policy file on the device remains the final authority. A cloud setting cannot override the machine owner.