[FEATURE] Expose plugin user_config values to skill script assets

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

Plugin userConfig values reach three places: MCP/LSP/hook command interpolation, CLAUDE_PLUGIN_OPTION_<KEY> env vars (hooks only), and SKILL.md body text substitution. A skill's own script assets (run via the Bash tool) get none of these — the Bash subprocess env comes from the user's shell profile, not from Claude. sensitive: true values are redacted from SKILL.md text too, so there's no way — supported or manual — for a skill script to use a secret like an API key.

Proposed Solution

Inject CLAUDE_PLUGIN_OPTION_<KEY> env vars into the Bash tool subprocess when the command runs a script under a plugin's skill directory — same mechanism hooks already use. Skill hooks (hooks frontmatter) already get this; extend it to plain skill scripts.

Alternative Solutions

Current workaround: model reads the substituted value from SKILL.md text and passes it as a CLI arg. Fails for sensitive options entirely, and leaks secrets into model context instead of a subprocess env var.

Priority

Medium - Would be very helpful

Feature Category

Configuration and settings

Use Case Example

1. Plugin declares sensitive: true apiKey option.
2. Skill's scripts/sync.sh needs to call an API with that key.
3. Today: no way to get it there.
4. Wanted: script reads $CLAUDE_PLUGIN_OPTION_APIKEY directly, like a hook would.

Additional Context

Verified against Claude Code v2.1.202. Skill hooks already get full user_config parity with plugin hooks (minus ${CLAUDE_PLUGIN_DATA}, plugin-only) via executeHookCommand — closest existing analog to this request.