[BUG] Skill dynamic injection blocks cat for files outside session working directory

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

The !command` dynamic injection syntax in SKILL.md files blocks cat` from reading files outside the current session's working directory. This breaks the documented pattern for injecting dynamic config into personal skills.

Personal skills live in ~/.claude/skills/<name>/, and the natural pattern is to store config alongside the skill:

---
name: my-skill
---

**Config:** !`cat ~/.claude/skills/my-skill/config.json 2>/dev/null || echo '{}'`

This worked previously but now fails with:

Bash command permission check failed for pattern
"!`cat ~/.claude/skills/my-skill/config.json 2>/dev/null || echo '{}'`":
cat in '/Users/<user>/workspace/dotfiles/claude/skills/my-skill/config.json'
was blocked. For security, Claude Code may only concatenate files from the allowed
working directories for this session: '/Users/<user>/workspace/<project>'.

The restriction makes sense for arbitrary bash commands, but ~/.claude/skills/ should be an allowed read path for skill injection since that's where personal skills and their configs live by definition.

What Should Happen?

!cat` in skill dynamic injection should be allowed to read files within ~/.claude/ (at minimum ~/.claude/skills/`), since personal skills are stored there and need access to their own config files.

Steps to Reproduce

1. Create a personal skill at ~/.claude/skills/my-skill/SKILL.md with dynamic injection:

``yaml
---
name: my-skill
---
**Config:** !cat ~/.claude/skills/my-skill/config.json 2>/dev/null || echo '{}'
``

1. Create a config file at ~/.claude/skills/my-skill/config.json
2. Open Claude Code in any project directory (e.g., ~/workspace/some-project)
3. Invoke the skill with /my-skill
4. Observe the "cat was blocked" error

Error Messages/Logs

Bash command permission check failed for pattern "!`cat ~/.claude/skills/my-skill/config.json 2>/dev/null || echo '{}'`": cat in '/Users/<user>/workspace/dotfiles/claude/skills/my-skill/config.json' was blocked. For security, Claude Code may only concatenate files from the allowed working directories for this session: '/Users/<user>/workspace/<project>'.

Note: the resolved path goes through a symlink (~/.claude/skills/my-skill -> ~/workspace/dotfiles/claude/skills/my-skill), which may be relevant to the path check.

Claude Model

Not sure / Multiple models

Is this a regression?

Yes — this pattern worked in earlier versions.

Claude Code Version

2.1.31

Platform

AWS Bedrock

Operating System

macOS

Terminal/Shell

iTerm2 / zsh

Additional Information

The skills documentation does not mention any working directory restriction on !command` injection. The symlinked path may also be a factor — the skill directory is symlinked from a dotfiles repo, so the resolved path is in ~/workspace/dotfiles/ rather than ~/.claude/`.