[BUG] Bug: Agent proxy fabricates messages on behalf of user in skill commands

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When executing a skill command (/commit) that delegates work to a subagent (git-committer), the main agent is supposed to act as a transparent proxy between the user and the subagent. Instead, the main agent:

1. Fabricated a message to the subagent ("Continue — prepare commit message and commit") that the user never wrote
2. Consumed the subagent's response without showing it to the user
3. Bypassed the subagent's approval gates by autonomously continuing the conversation
4. When the user criticized this behavior, redirected the criticism to the subagent instead of self-reflecting

The main agent acted as an autonomous participant in the conversation with the subagent, impersonating the user. This is a trust/security violation — the user has no control over what is communicated to the subagent in their name.

Root cause

There is no enforced constraint preventing the main agent from writing arbitrary content in the prompt field when resuming a subagent via the Task tool. Rules in CLAUDE.md and skill definitions are advisory, not enforced.

Impact

Security: The user's agency is bypassed. Approval gates defined in the subagent workflow become meaningless if the proxy can auto-approve on behalf of the user.

Environment

• Claude Code CLI
• Model: claude-opus-4-6
• Subagent: git-committer (sonnet)

What Should Happen?

The main agent MUST:

• Show every subagent response to the user verbatim
• Wait for the user's response before resuming the subagent
• Pass user messages to the subagent without modification
• Never fabricate messages on behalf of the user

Error Messages/Logs

Steps to Reproduce

1. Define a subagent (e.g. git-committer) with a multi-step workflow requiring explicit user approval at each step
2. Define a skill command (e.g. /commit) that instructs the main agent to act as a transparent proxy:

• Show subagent responses to the user verbatim
• Pass user responses to the subagent verbatim
• Never fabricate messages

1. Invoke the skill command
2. Observe: the main agent launches the subagent, receives its first response, and instead of showing it to the user and waiting, immediately

resumes the subagent with a self-fabricated message

1. The subagent's approval gates are bypassed — the user never gets to approve or reject

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.38

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

IntelliJ IDEA terminal

Additional Information

_No response_