plugin-dev:command-development skill fails to load due to bash security check false positive

Describe the bug

The plugin-dev:command-development skill fails to load because Claude Code's bash security validation incorrectly flags a documentation example as dangerous.

When invoking the skill via /plugin-dev:command-development or using the Skill tool, the following error occurs:

Error: Bash command permission check failed for pattern "!`echo "$1" | grep -E "^(dev|staging|prod)$" || echo "INVALID"`": Command contains locale quoting which can hide characters

To Reproduce

1. Install the plugin-dev plugin: /plugin install plugin-dev@claude-plugins-official
2. Run /plugin-dev:command-development
3. Observe the error

Expected behaviour

The skill should load successfully. Documentation examples within SKILL.md should not trigger bash security validation.

Root Cause Analysis

The problematic content is in the skill's SKILL.md file at approximately line 763:

\\\markdown
Validate environment: !\echo "$1" | grep -E "^(dev|staging|prod)$" || echo "INVALID"\
\\\

Claude Code's bash security validation (in cli.js) detects the pattern $" in echo "$1" and interprets it as bash locale quoting ($"..." syntax), which triggers the security check:

\\\javascript
if(/\$"[^"]*"/.test(Q))
return {behavior:"ask", message:"Command contains locale quoting which can hide characters"};
\\\

The issue is that when loading a skill, the content is parsed for bash patterns (the \!\...\\ syntax used for inline bash execution in commands). Documentation examples containing bash code are being validated as if they were actual commands to execute.

Environment

• Claude Code version: Latest (as of 2025-01-09)
• OS: Linux (WSL2)
• Plugin: plugin-dev@claude-plugins-official

Suggested Fix

Either:

1. Skip bash security validation for content that appears within markdown code blocks (```) in skill files
2. Adjust the regex to not match $" when it's part of a variable reference like "$1" (the $ belongs to $1, not to $"..." locale quoting)
3. Only validate bash patterns that will actually be executed, not documentation examples

---

🤖 Generated with Claude Code