Feature: opt-in suppression of CLAUDE.md / skill-catalog injection on subagent dispatch

Use case

Building skills that dispatch a subagent for adversarial review of work the principal just did — the goal is the inner reviewer arrives at the artifact without inheriting the principal's framing, conventions, or stated preferences. The design depends on the subagent's judgment being independent of the parent's.

Current behavior

When dispatching via the Agent tool (subagent_type: "general-purpose" or any custom type), the harness automatically prepends to the subagent's system message:

• The user's global ~/.claude/CLAUDE.md
• The project's ./CLAUDE.md (if present)
• The full skill catalog (every available skill's name + description, including ones with user-identifying info like personal style guides)
• Auto-memory hints

The dispatch prompt cannot suppress any of this. Per the docs: "CLAUDE.md files and project memory still load through the normal message flow" regardless of subagent type.

Net effect: any "isolated reviewer" pattern is leaky by default. The reviewer sees the principal's preferences, knows whose work they're reviewing (via skill names), and can be influenced by codified opinions even when the dispatch prompt explicitly asks it not to.

Proposed mechanism

Opt-in flag, on any of these surfaces:

1. Env var matching existing precedent: CLAUDE_SUBAGENT_SUPPRESS_INJECTION=1 (same style as CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1).
2. Agent tool parameter: Agent(..., context: "minimal") or Agent(..., suppress_claude_md: true).
3. Custom subagent type config: add inject_claude_md: false / inject_skill_catalog: false to the YAML frontmatter of files under ~/.claude/agents/. Most fine-grained — lets users opt specific subagent types in.

Any of these would unblock the adversarial-review use case. (3) is probably the cleanest match for how custom subagent types are already configured.

Prior art

CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1 establishes the pattern of env-gated opt-in for advanced subagent behaviors.

Workarounds today

• Document the limitation in skills so users don't overclaim isolation (just did this in our red-team skill).
• Bypass the Agent tool entirely, call the Anthropic SDK from a Bash tool — works but loses Claude Code's permission/tool/billing integration.

A first-class flag would be much cleaner than either workaround.