docs: document async tools, deserialization allowlist, and SkillToolset

[julian-risch]

Related Issues

• Resolves four more subtasks of deepset-ai/haystack-private#381:
  • feat: Add support for async functions inside of Tool #11426
  • feat!: Gate pipeline deserialization through a module allowlist #11432
  • feat: Add SkillsToolset to enable Haystack's Agent to read Skills #11459
  • feat: Adding ImageContent and FileContent support to read_skill_file in SkillsToolset #11681

Proposed Changes:

• feat: Add support for async functions inside of Tool #11426 Async tools — Tool docs: the dataclass listing now includes async_function, and a new "Async Tools" section covers @tool on async def, the invoke/invoke_async interaction , and cross-linked notes on ComponentTool and PipelineTool.
• feat!: Gate pipeline deserialization through a module allowlist #11432 Deserialization allowlist — new "Deserialization Security" section on the Serializing Pipelines page: the trusted-module allowlist and its defaults, the blocked dangerous builtins, the three ways to extend the allowlist (allowed_modules kwarg, allow_deserialization_module, HAYSTACK_DESERIALIZATION_ALLOWLIST env var), pattern-matching rules, the unsafe=True escape hatch, and the nested init_parameters validation with its "may surface pre-existing YAML bugs" caveat.
• feat: Add SkillsToolset to enable Haystack's Agent to read Skills #11459/feat: Adding ImageContent and FileContent support to read_skill_file in SkillsToolset #11681 SkillToolset — new SkillToolset page: discovery concept, two tools, the SKILL.md format with filesystem layout, FileSystemSkillStore and the SkillStore protocol for custom backends, the one-toolset-per-Agent limitation, and multimodal skill assets. Added to the sidebar after SearchableToolset.

How did you test it?

• Tested against the v3: async @tool routing and invoke_async fallback, ToolInvocationError from sync invoke on async-only tools, DeserializationError for untrusted modules, the allowed_modules/unsafe kwargs and allow_deserialization_module import path, and a full SkillToolset round trip over a temporary skills directory.

Notes for the reviewer

Checklist

• I have read the contributors guidelines and the code of conduct.
• I have updated the related issue with new insights and changes.
• I've used one of the conventional commit types for my PR title: fix:, feat:, build:, chore:, ci:, docs:, style:, refactor:, perf:, test: and added ! in case the PR includes breaking changes.
• I have run pre-commit hooks and fixed any issue.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
haystack-docs	Ready	Preview, Comment	Jul 5, 2026 8:10pm