Auto mode classifier blocks reading a file from the user's own installed skill as "Containment Escape"

In a claude.ai cloud session, Claude ran sed -n 40,200p on a script inside one of the user's own installed skills (browserbase-contexts/scripts/rc.py) to understand how it connects to the user's own self-hosted browser. The auto mode classifier denied the read as [Containment Escape].

Reading a local file the user installed is not an escape. The block stopped work the user had explicitly delegated ("do as you see fit"), and the denial gave no way to proceed or to ask the user for permission.

Expected: local reads of the user's own skill files are allowed. If the classifier objects to the plan rather than the read, it should offer to ask the user rather than hard-deny.

Related: #101769.