[BUG] Inline command execution (\!`cmd`) in plugin skills fails with permission error — allowed-tools cannot grant permission

Description

Inline command execution (` !command ) in plugin skill SKILL.md files triggers a shell command permission check failure. The allowed-tools frontmatter field cannot grant permission for these commands because allowed-tools controls what tools the model can use **after** the skill loads, while !command ` runs during skill loading as a preprocessor step.

Reproduction

Plugin structure:

my-plugin/
├── .claude-plugin/
│   └── plugin.json
└── skills/
    └── my-skill/
        ├── SKILL.md
        └── scripts/
            └── introspect.sh    # simple script that outputs text

SKILL.md:

---
name: my-skill
description: Example skill with inline command
allowed-tools: ["Bash(${CLAUDE_SKILL_DIR}/scripts/*:*)"]
---

## Live data

!`"${CLAUDE_SKILL_DIR}/scripts/introspect.sh"`

Steps:

1. claude --plugin-dir ./my-plugin
2. Invoke the skill (either via /my-plugin:my-skill or by triggering it)
3. Observe: "Shell command permission check failed" error during skill loading

Expected behavior

The ` !command ` should execute without a permission prompt when:

• The script is bundled within the skill's own directory (${CLAUDE_SKILL_DIR})
• The skill's allowed-tools includes a matching Bash pattern

Or: a dedicated frontmatter field (e.g., allowed-inline-commands) should exist to grant permission for the preprocessor step.

Workaround

Remove ` !command and instead instruct Claude to run the script via the Bash tool after loading. The allowed-tools` field does cover Bash tool invocations.

Related issues

• #14956 — allowed-tools doesn't grant permission for Bash tool calls post-load (same allowed-tools gap, different phase)
• #24203 — ` !command ` blocked by sandbox for files outside working directory (closed as stale, unfixed)
• #34900 — Same as #24203 but for plugins reading their own files (closed as duplicate)

Environment

• Claude Code version: 2.1.81
• OS: macOS (Darwin 25.3.0)
• Plugin loaded via both --plugin-dir and marketplace installation