[BUG] Skill sub-files require explicit read permission despite skill being loaded from the same directory

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When a custom skill is loaded from a directory (e.g., ~/.claude/skills/some-skill/), Claude Code correctly reads the SKILL.md file without issue. However, when that skill references other files within the same skill directory (e.g., cookbook/list.md), Claude Code treats them as untrusted and prompts the user for read permission.

This means every supporting file inside the skill's own directory tree triggers a permission prompt, even though the skill itself was already trusted and loaded by Claude Code.

What Should Happen?

When Claude Code loads a skill from a directory, it should implicitly grant read permission to all files within that skill's directory tree. If the SKILL.md at ~/.claude/skills/some-skill/SKILL.md is trusted, then ~/.claude/skills/some-skill/*, any other files under that skill root should also be readable without prompting.

The skill directory should be treated as a single trust boundary.

Error Messages/Logs

Steps to Reproduce

1. Create a custom skill at ~/.claude/skills/<skill-name>/SKILL.md
2. Add supporting files in subdirectories (e.g., <skill-name>/cookbook/list.md)
3. In SKILL.md, reference those files (e.g., "Read cookbook/list.md")
4. Invoke the skill in any project
5. Observe: SKILL.md loads fine, but every sub-file triggers a read permission prompt

Claude Model

None

Is this a regression?

No, this never worked

Last Working Version

N/A

Claude Code Version

2.1.81 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Other

Additional Information

Current workaround is adding Read(~/.claude/skills/**) to ~/.claude/settings.json under permissions.allow. This works but requires manual setup and is something users shouldn't need to configure for files that are part of a skill they already opted into loading.

This becomes especially painful for skills with many supporting files (templates, checklists, guides, etc.) where the user gets prompted repeatedly during a single skill invocation.