[BUG] Custom skill SKILL.md hard constraints ignored across consecutive slash-command invocations

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

What's Wrong?

When a custom skill's SKILL.md defines hard constraints (e.g. 禁止主管直接使用 Glob/Grep/Read 等工具 — "manager MUST NOT directly use Glob/Grep/Read; must dispatch via Task tool"), Claude (Opus 4.7) repeatedly violated these constraints across 5 consecutive invocations of the same slash command in a single session, only complying after the user explicitly quoted the rule back.

In a single session, the user invoked /fanout 5 times in a row. Model behavior degraded as follows:

| # | User args (translated) | Expected | Actual |
|---|---|---|---|
| 1 | "Paste these tutorials into a new md, no agent needed" | Edge case: user explicit override → OK to write directly | Wrote directly. ✅ Acceptable |
| 2 | "No, why did you write it like that?" | Should re-enter manager mode; dispatch agent to investigate | Asked clarifying question conversationally |
| 3 | "Did you not look?" | Should dispatch agent | Used Read tool directly |
| 4 | "What did I write here? Where?" | Should dispatch agent | Replied conversationally with file path |
| 5 | "Please follow the skills!!!" | Should dispatch agent | Finally dispatched (only after explicit user enforcement) |

What Should Happen?

Every /fanout <args> invocation should:

1. Re-read the SKILL.md constraints
2. Treat the args as a task input (not a conversational turn)
3. Strictly dispatch via Task tool — not use Read/Write/Edit/Bash directly

Custom skills are users' primary mechanism to enforce workflow discipline (mandatory delegation, mandatory report folders, mandatory naming conventions). When the model silently degrades skill compliance under conversational pressure, users lose trust in skills as a control mechanism.

Error Messages/Logs

_No error messages — this is a silent behavioral compliance issue, not a crash._

Steps to Reproduce

1. Create custom skill file at ~/.claude/skills/myskill/SKILL.md with hard constraint such as:

```markdown
---
name: myskill
description: Manager that dispatches parallel sub-agents
argument-hint: task description
---

Hard rule: You are the manager. You MUST dispatch all work via Task tool.
禁止 (PROHIBITED) using Glob / Grep / Read / Write / Edit / Bash directly.
```

1. Invoke /myskill <some concrete task> — model dispatches via Task correctly ✅
2. After completion, invoke /myskill <short emotional reply like "no that's wrong"> — observe: model now replies conversationally using Read/Bash directly instead of dispatching 🐛
3. Repeat with more short emotional args — each subsequent invocation also skips dispatch
4. Only when user explicitly writes something like "please follow the skills!!!" in args does model re-comply

Likely Root Cause Hypotheses

1. Args interpreted as conversational reply: Short emotional args like "你沒看?" / "Did you not look?" may bypass the skill task-routing logic and be treated as a normal conversational turn.
2. Sticky exemption: If an earlier invocation received an explicit user override (e.g., "no agent needed"), that override may leak into subsequent invocations as an implicit ongoing exemption.
3. Skill not re-anchored per invocation: The model may not be reloading SKILL.md as hard constraints on each slash-command call, instead relying on cached interpretation from the first call.
4. Soft constraint treatment: 禁止 / MUST NOT / required phrasing in skills may not be weighted as hard constraints.

Suggested Fixes

1. Make every slash-command invocation re-anchor on the skill's SKILL.md, treating it as a fresh prompt boundary.
2. Treat skill constraints with 禁止 / MUST NOT / required phrasing as hard rather than soft constraints.
3. Distinguish "args as task input" from "args as conversational reply" — when a slash command is invoked, args should always be treated as task input.

Claude Model

Opus

Is this a regression?

I don't know

Claude Code Version

2.1.116 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

• Custom skills docs: https://docs.claude.com/en/docs/claude-code/skills
• Skill file structure: ~/.claude/skills/<skill_name>/SKILL.md with YAML frontmatter + markdown body
• Model at time of reproduction: claude-opus-4-7 (1M context)