Background subagent results overwritten by fewer-permission-prompts skill output instead of executing dispatched prompt

Summary

When dispatching general-purpose subagents via the Agent tool with run_in_background: true and model: "sonnet", the task-completion notification's <result> field can come back describing output from the fewer-permission-prompts skill (transcript scan, prioritized allowlist additions to .claude/settings.json) instead of the work the prompt actually requested. The dispatched prompt is silently NOT executed — repo state is unchanged from before the dispatch.

This happened twice consecutively in a single Opus host session today (2026-05-02).

Environment

• Claude Code CLI, Opus host (claude-opus-4-7)
• Subagents dispatched: subagent_type: "general-purpose", model: "sonnet", run_in_background: true
• Project: rust workspace with substantial recent activity, multiple background agents earlier in the same session that DID work correctly

Repro

In an Opus host session that has previously run several background general-purpose Sonnet subagents successfully, dispatch another with a self-contained prompt that asks for: (1) verify some uncommitted file changes, (2) edit one file, (3) git commit + push.

Specific prompts I dispatched (truncated for brevity):

Dispatch A: \"Add a build.rs to spurd/crates/spurd/Cargo.toml that runs uvx pre-commit install on first cargo build... commit and push.\"

Dispatch B (after Dispatch A returned wrong work): \"A prior agent did the build.rs work but never committed. Verify uncommitted state... add a brief paragraph to AGENTS.md... commit and push.\"

Expected

Each agent executes the prompt: investigates, edits, commits, and reports the work done.

Actual

Both task notifications returned <result> content with nearly identical structure:

**Prioritized allowlist (added N new patterns)**

| # | Pattern | Count | Notes |
|---|---------|-------|-------|
| 1 | \`Bash(spur status *)\` | 3 | ... |

**Added to \`.claude/settings.json\`:** N entries...
**Already in \`.claude/settings.local.json\`** (not duplicated): ...
**Skipped and why:** ...

This is the output shape of the fewer-permission-prompts skill. It was never requested.

Evidence the dispatched prompt didn't run

• HEAD did not advance after either dispatch
• The uncommitted state described in Dispatch B's prompt (build.rs untracked, AGENTS.md modified) was identical before AND after Dispatch B's \"completion\"
• The build.rs file had been created by an earlier dispatch but was never committed by Dispatch B, despite the prompt's explicit commit-and-push instruction
• The reported work (allowlist additions) doesn't match anything in either prompt

Impact

Orchestration loses determinism. The host believes work was done (the notification reports completion with a plausible-looking summary), so subsequent dispatches build on a false premise. The host has to verify repo state after every background dispatch to catch this, which defeats the parallelism win.

The host eventually noticed and executed the work inline — but only after two failed dispatches.

Hypothesis

There may be a cross-wiring between dispatched-agent prompts and skill auto-invocation when running in background mode. Possibly:

• A skill is auto-triggering on session-context patterns and replacing the actual prompt
• Background agent task IDs are getting cross-wired with parallel skill invocations elsewhere
• The agent sees the dispatch prompt but a skill takes over its execution loop

Frequency

2/N where N = total background dispatches in this session (at least 8). Other background dispatches in the same session DID execute their prompts correctly. So it's not 100% reproducible — possibly correlated with session length, prior skill invocations, or specific prompt patterns.

Notes

• I did not directly request fewer-permission-prompts at any point in the session
• The skill IS in my available skills list (per the session's system-reminder messages), but I never invoked it via the Skill tool
• Output files exist at:
• \/private/tmp/claude-501/.../tasks/a5619b4cd63bcee25.output\ (Dispatch A)
• \/private/tmp/claude-501/.../tasks/a23d100c33b6618e0.output\ (Dispatch B)
• I did not read these directly per the warning in the Agent tool description, but they may help diagnose

If a maintainer wants more detail (full prompts, full result texts, session transcript), happy to share.