[MODEL] Inline shell commands in skill definitions bypass dedicated tool preferences

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Other unexpected behavior

What You Asked Claude to Do

Invoked a custom skill that contains inline shell commands in its definition, such as the following from the claude-md-management plug-in:

find . -name "CLAUDE.md" -o -name ".claude.md" -o -name ".claude.local.md" 2>/dev/null | head -50

What Claude Actually Did

Claude executed the shell command verbatim via the Bash tool (find ... | head) instead of
translating the intent to its dedicated Glob tool (e.g.: Glob pattern: "**/CLAUDE.md").

This also propagated to subagents: an Explore agent spawned during the same session used Bash with
grep/find for codebase exploration rather than the dedicated Grep/Glob tools.

Expected Behavior

When skill, command, or agent definitions contain inline shell commands, Claude should treat them as
intent descriptions (what to accomplish) rather than literal tool invocations (how to do it).
The system prompt already instructs Claude to prefer dedicated tools over Bash equivalents, but this
rule is ignored/overridden when injected skill content contains explicit shell commands.

For example, Claude should translate:

| Skill shell command | Dedicated tool equivalent |
|------------------------|---------------------------|
| find . -name "*.md" | Glob(pattern: "**/*.md") |
| grep -r "pattern" . | Grep(pattern: "pattern") |
| cat file.txt | Read(file_path: "file.txt") |
| head -50 file.txt | Read(file_path: "file.txt", limit: 50) |

Files Affected

settings.local.json (for addition of permissions that should not have been necessary)

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Yes, every time with the same prompt

Steps to Reproduce

1. Create or install a skill with inline shell commands in its definition (e.g.: a skill containing

find . -name "CLAUDE.md" | head -50)

1. Invoke the skill
2. Observe that Claude executes the shell command via Bash rather than translating to Glob/Grep/Read

Claude Model

Opus

Relevant Conversation

Claude diagnosed the problem after I asked about use of bash instead of dedicated tools with the following question during a session where I had noticed permission prompts for operations that should have been possible with dedicated tools:

❯ you seem to using your Bash tool with grep instead of using your Grep     
  tool.  are you able to determine why this is occuring?

Impact

Medium - Extra work to undo changes

Claude Code Version

2.1.34 (Claude Code)

Platform

Anthropic API

Additional Context

_Here is some additional information that Claude provided when asked to create a draft for this issue:_

Root Cause Analysis

Claude's system prompt contains clear instructions to prefer dedicated tools:

Do NOT use the Bash to run commands when a relevant dedicated tool is provided.

However, when a skill definition is loaded into context, its inline shell commands act as competing
instructions. The model interprets the definition content as an authoritative directive to run that
specific command, which overrides the general tool-preference rules.

This is a distinct trigger from the model simply "falling back" to familiar Bash idioms on its own
(as documented in #19649). In this case, the model is actively directed by injected content to use
Bash.

Suggested Fixes

1. Skill/command processing layer: When loading skill or command definitions, the system could

annotate or preprocess inline shell commands with a reminder that they should be translated to
dedicated tool equivalents.

1. System prompt clarification: Add explicit guidance such as:

> When skill, command, or agent definitions contain inline shell commands (e.g.: find, grep,
> cat), always translate them to the equivalent dedicated tools (Glob, Grep, Read). Treat
> commands in definitions as descriptions of intent, not literal tool invocations.

1. Skill authoring guidance: Document that skill authors should avoid inline shell commands where

a dedicated tool exists, or use pseudocode/natural language descriptions instead.

Impact

Medium - Causes unnecessary Bash permission prompts, bypasses safety features of dedicated tools
(e.g.: Edit's uniqueness validation), and reduces the effectiveness of skills that were designed to
leverage Claude's built-in capabilities.