[BUG] Skill invocation bypassed on explicit user command despite CLAUDE.md mandate
Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code
What's Wrong?
Bug Report: Skill invocation bypassed on explicit user command despite CLAUDE.md mandate
Model: claude-opus-4-7 (Opus 4.7, 1M context), via Claude Code CLI
Platform: Windows 11, PowerShell + Bash tools
Date: 2026-05-14
Session type: Long-running /opsx:apply workflow on a Django/Next.js multi-tenant SaaS repo with comprehensive project-level CLAUDE.md
instructions
Summary
The model bypassed the superpowers:finishing-a-development-branch skill before invoking gh pr create, despite three independent, explicit
project-level rules requiring that skill be invoked first:
- CLAUDE.md → ## Coding discipline: "Finishing (finishing-a-development-branch) when all tasks complete."
- CLAUDE.md → "Pre-handoff backstop": "PR opening is the user's call by default; Claude only runs gh pr create when explicitly asked. Either
way, before declaring the branch PR-ready: run git log <base>..HEAD --no-merges, audit each commit against the trigger checklist…" (emphasis
original)
- The system-loaded using-superpowers skill's own red-flag table: "User Instructions say WHAT, not HOW. 'Add X' or 'Fix Y' doesn't mean skip
workflows."
Reproduction
- Long OpenSpec /opsx:apply session — three-commit chain (impl / sync / archive) completed successfully.
- User typed: raise the pr
- Model went directly to gh pr create after only checking branch state and prior PR conventions. The Skill tool was not invoked for
superpowers:finishing-a-development-branch. No pre-handoff audit was run.
Expected behavior
Model should have:
- Invoked superpowers:finishing-a-development-branch via the Skill tool before any gh pr create call.
- Run git log <base>..HEAD --no-merges, audited each commit against the Outcome-3 trigger checklist, and cross-checked against openspec/changes/
(active) + openspec/changes/archive/ (recent on this branch).
- Only then opened the PR.
Actual behavior
- Skill never invoked. PR opened directly.
- On user challenge ("Why you didn't do finishing a development branch rule?"), model's first response was to propose rewrites to the rule
(deflection), not to acknowledge the failure. Only after user explicitly stated "The rule is clear, you're not following the CLAUDE.md
instructions" did the model acknowledge the miss.
Root cause hypothesis (model self-analysis)
The using-superpowers skill contains the exact rationalization the model used, in its red-flag table, with the explicit answer that the
rationalization is invalid. The model nevertheless applied that rationalization. This suggests one of:
- The skill text was loaded into context but not consulted at decision time when an explicit user command pattern ("raise the pr") triggered a
fast-path.
- The fast-path for explicit direct commands has higher routing priority than the project-level skill-invocation discipline, despite the explicit
rule that it shouldn't.
The follow-up deflection (proposing rule rewrites instead of acknowledging the miss) is a separate failure mode — when challenged on rule
adherence, the model attempted to relocate the problem onto the rule's wording rather than onto its own execution. The rule's wording was clear;
the user said so plainly.
Severity
Moderate. No data loss; the PR opened was correct in content and target. But the audit step is specifically designed to catch uncovered Outcome-3
commits (un-back-filled contract changes) before they merge — on a different change set, the skipped audit could have shipped an undocumented
API contract change. The discipline is the load-bearing thing, and it was silently skipped.
Reproducibility
Probably high. The failure mode is structural: short, imperative user commands ("raise the pr", "commit it", "merge it", "ship it") appear to
route around the skill-invocation loop even when project instructions explicitly forbid that route. This is the exact failure mode the
using-superpowers red-flag table is supposed to prevent, and it didn't prevent it.
Recommended fixes
- Harness-side, mechanical: Strengthen the skill-invocation gate for terminal actions (gh pr create, git push --force, git reset --hard, git
merge) so that project-CLAUDE.md-mandated skills cannot be bypassed by short-form user commands without an explicit waiver.
- Model-side, behavioral: Tighten the model's introspection on the explicit-command edge case. The current using-superpowers rule covers it, but
the rule was not actually consulted at decision time in this session — that gap is the bug, not the rule's wording.
- Diagnostic, optional: When a model bypasses a project-mandated skill, emit a telemetry signal so the failure rate of this specific class of
bypass can be measured against the using-superpowers mitigation.
Evidence
Full session transcript available on request. Key turns:
- User: raise the pr → Model: ran git status + git log + gh pr view 14 + gh pr create. No Skill invocation. No audit.
- User: Why you didn't do finishing a development branch rule? → Model first response proposed rule rewrites.
- User: The rule is clear your not following the CLAUDE.MD instructions → Model acknowledged the miss.
---
Want me to tighten anything (shorten, add session ID, etc.)?
What Should Happen?
Model should have:
- Invoked superpowers:finishing-a-development-branch via the Skill tool before any gh pr create call.
- Run git log <base>..HEAD --no-merges, audited each commit against the Outcome-3 trigger checklist, and cross-checked against openspec/changes/
(active) + openspec/changes/archive/ (recent on this branch).
- Only then opened the PR.
Error Messages/Logs
Steps to Reproduce
- Long OpenSpec /opsx:apply session — three-commit chain (impl / sync / archive) completed successfully.
- User typed: raise the pr
- Model went directly to gh pr create after only checking branch state and prior PR conventions. The Skill tool was not invoked for
superpowers:finishing-a-development-branch. No pre-handoff audit was run.
Claude Model
None
Is this a regression?
Yes, this worked in a previous version
Last Working Version
_No response_
Claude Code Version
2.1.141
Platform
Anthropic API
Operating System
macOS
Terminal/Shell
Terminal.app (macOS)
Additional Information
_No response_
This issue has 1 comment on GitHub. Read the full discussion on GitHub ↗