[BUG] Inconsistent tool permission behavior in skill's allowed-tools

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When a skill is invoked with tools listed in its allowed-tools, some Bash commands run without permission while others still prompt for permission, despite both being listed in the skill's allowed-tools.

Specifically:

• Bash(acli:*) commands run without permission
• Bash(curl:*) commands still ask for permission

Both tools are:

1. Listed in the skill's allowed-tools in SKILL.md
2. NOT in the global ~/.claude/settings.json permissions.allow array
3. Being used during the same skill invocation

What Should Happen?

• acli commands run without permission (expected)
• curl commands prompt for permission (unexpected)

Steps to Reproduce

1. Setup skill with allowed-tools:

Create a skill at ~/.claude/skills/test/SKILL.md with:
```yaml
---
name: test-skill
description: test-skill
allowed-tools: ["Bash(acli:)", "Bash(curl:)",
---

1. Configure global permissions:

In ~/.claude/settings.json:

  {
    "permissions": {
      "allow": [
        "Skill(jira)",
         "Read(~/.claude/**/*)",
          // Note: Bash(acli:*) and Bash(curl:*) are NOT here
      ]
    }
  }

1. Invoke the skill

Expected Behavior

• Both acli and curl commands should run without asking for permission.

Actual Behavior

• acli commands run without permission (expected)
• curl commands prompt for permission (unexpected)

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.0.62

Platform

AWS Bedrock

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_