Bug: allowed-tools in skill frontmatter not enforced

Summary

The allowed-tools field in skill/command frontmatter does not appear to be enforced. Claude can freely use tools not listed in allowed-tools.

Reproduction

1. Create a skill with restricted allowed-tools:

---
description: Orchestration workflow
allowed-tools: Read, Glob, Grep, Task, TodoWrite, AskUserQuestion, Bash
---

Note: Edit, Write, and NotebookEdit are intentionally not in the list.

1. Invoke the skill (e.g., /implement)

1. Ask Claude to make code changes

1. Expected: Claude should be blocked from using Edit/Write tools
2. Actual: Claude uses Edit/Write freely with no restriction or warning

Evidence

In a recent session, my /implement skill explicitly excluded Edit/Write/NotebookEdit from allowed-tools, intending to force delegation to sub-agents. Despite this:

• Claude used Edit tool 5+ times
• Claude used Write tool 1 time
• No warning or block was triggered
• The skill's orchestration pattern was completely bypassed

Expected Behavior

When a skill defines allowed-tools, Claude should:

1. Only be able to use tools in that list
2. Receive an error/warning when attempting to use unlisted tools
3. Be reminded of the skill's constraints

Current Behavior

allowed-tools appears to be ignored entirely. Claude can use any tool regardless of what the skill permits.

Impact

This makes it impossible to create orchestration-style skills where Claude should delegate work to sub-agents rather than doing work directly. The entire skill pattern breaks down.

Environment

• Claude Code CLI
• Custom skill in .claude/commands/implement.md
• Using Task tool for sub-agent delegation