[BUG] allowed-tools in skill SKILL.md only auto-approves the first Bash call per session, subsequent calls prompt for permission

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

A plugin skill declares multiple allowed-tools patterns in its SKILL.md frontmatter. When the skill is loaded, it correctly reports "3 tools allowed". However, only the first Bash command in a session is
auto-approved — all subsequent Bash calls prompt for manual permission, even when using the exact same script and pattern.

What Should Happen?

All Bash calls matching allowed-tools patterns should be auto-approved for the duration of the skill's activation, not just the first one.

Error Messages/Logs

Steps to Reproduce

1. Install plugin with the skill above. Start Claude Code with a fresh ~/.claude and ~/.claude.json (no saved permissions).
2. Test 1 — first script runs, second prompts:

```
> run script_a on item-1

Skill loaded · 3 tools allowed
Bash(/home/user/.claude/plugins/cache/my-plugin/0.1.0/skills/my-analyzer/scripts/script_a.sh item-1 --human)
⎿ runs successfully, no prompt

> now run script_b on item-2

Bash(/home/user/.claude/plugins/cache/my-plugin/0.1.0/skills/my-analyzer/scripts/script_b.sh item-2)
⎿ This command requires approval ← unexpected
```

1. Test 2 — order reversed, same result (fresh container):

```
> run script_b on item-2

Skill loaded · 3 tools allowed
Bash(/home/user/.claude/plugins/cache/my-plugin/0.1.0/skills/my-analyzer/scripts/script_b.sh item-2)
⎿ runs successfully, no prompt

> now run script_a on item-1

Bash(/home/user/.claude/plugins/cache/my-plugin/0.1.0/skills/my-analyzer/scripts/script_a.sh item-1 --human)
⎿ This command requires approval ← unexpected
```

1. Test 3 — same script, different args (fresh container):

```
> run script_a on item-1

Skill loaded · 3 tools allowed
Bash(.../scripts/script_a.sh item-1 --human)
⎿ Interrupted by user

> run script_a on item-2

Bash(.../scripts/script_a.sh item-2 --human)
⎿ This command requires approval ← unexpected
```

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.144

Platform

Google Vertex AI

Operating System

Other Linux

Terminal/Shell

Non-interactive/CI environment

Additional Information

SKILL.md frontmatter:

---
name: my-analyzer
description: Analyze test failures using custom scripts.
allowed-tools: Bash(*/my-analyzer/scripts/script_a.sh *),Bash(*/my-analyzer/scripts/script_b.sh *),Bash(*/tools/*/install.sh *)
  ---