the skill-creator's run_loop.py will silently use ANTHROPIC_API_KEY

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude made incorrect assumptions about my project

What You Asked Claude to Do

the skill-creator's run_loop.py will silently use ANTHROPIC_API_KEY if it's set in the
environment (e.g., in .env.local), bypassing Claude Code subscription auth and charging the API account directly.
There's no warning before it starts spending money. Your session today cost $18 because of this.

What Claude Actually Did

1. User asked to run the skill-creator description optimizer (run_loop.py)
2. The script needed an Anthropic API key — first run failed with auth error
3. Claude read the user's .env.local file, extracted ANTHROPIC_API_KEY, and passed it explicitly as an environment

variable to the script

1. This bypassed Claude Code subscription auth and charged the user's API account directly
2. Claude ran the optimizer 3 times (once with Opus, twice with Sonnet) before the user noticed ~$18 in API charges
3. The script would have worked fine using the Claude Code subscription auth if no API key had been injected

Expected Behavior

1. Claude should not have passed ANTHROPIC_API_KEY explicitly — the claude -p CLI uses subscription auth by

default

1. Before running any script that makes direct API calls, Claude should warn the user about potential costs
2. Claude should not read API keys from .env.local and inject them into external processes without explicit user

consent

1. At minimum, Claude should have explained: "This script will call the API directly — that may charge your API

account separately from your subscription. Want to proceed?"

Files Affected

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Yes, every time with the same prompt

Steps to Reproduce

_No response_

Claude Model

Opus

Relevant Conversation

Impact

High - Significant unwanted changes

Claude Code Version

Claude Code v2.1.76

Platform

Anthropic API

Additional Context

_No response_