[BUG] Skill invocation fails (<error>Execute skill: NAME</error>) when SKILL.md has disallowed-tools and permission mode is acceptEdits (2.1.220)

Environment

• Claude Code 2.1.220
• Windows 11 Pro (10.0.26200), PowerShell 5.1 host shell
• Project skills in <repo>/.claude/skills/<name>/SKILL.md
• Reproduced in headless runs (claude -p) spawned from within an interactive session; interactive-mode behavior not separately tested

Summary

When a skill's SKILL.md frontmatter contains disallowed-tools, invoking that skill via the Skill tool fails to load the skill under --permission-mode acceptEdits. The Skill tool returns only:

<error>Execute skill: <name></error>

and no skill content is injected. The same skill loads fine in default mode, plan mode, and under --dangerously-skip-permissions. Skills without disallowed-tools load fine under acceptEdits.

Repro

1. Create a minimal project skill:

---
name: money-path
description: Read-only audit of the payments path. Use when asked to verify payments.
disallowed-tools: Edit Write NotebookEdit
---

# Audit checklist
(any content)

1. Run headless with acceptEdits:

claude -p "Invoke the money-path skill via the Skill tool. Report one line: did it load instructions (quote its first markdown heading) or did it error (quote the error verbatim). Then stop." --permission-mode acceptEdits --max-turns 4

1. Observe: <error>Execute skill: money-path</error>, no content loaded.

1. Re-run without --permission-mode (default), with --permission-mode plan, or with --dangerously-skip-permissions: the skill loads and quotes its first heading.

Results matrix (each cell = separate fresh claude -p run)

| Skill has disallowed-tools? | default | plan | bypassPermissions | acceptEdits |
|---|---|---|---|---|
| Yes (Edit Write NotebookEdit) | loads ✅ | loads ✅ | loads ✅ | fails ❌ (2/2 runs) |
| Yes (Edit NotebookEdit only, different skill) | loads ✅ | — | — | fails ❌ (1/1 run) |
| No (unmodified sibling skill, same repo) | loads ✅ | — | — | loads ✅ |

The failure reproduced 3/3 across two different skills carrying the field; the only varying factor vs. the passing runs is disallowed-tools presence × acceptEdits mode.

Expected

Either the skill loads and the disallowed tools are denied (as in the other modes), or — if the field is genuinely incompatible with acceptEdits — a meaningful error naming the conflict. Execute skill: <name> with no detail gives the user nothing to act on.

Two additional observations (working as intended? then possibly a docs nuance)

• The docs describe disallowed-tools as "tools removed from Claude's available pool while this skill is active." Observed behavior (default/bypass modes) is call-time denial, not schema removal: Edit/Write remain visible in the model's tool list, and a call returns Permission to use Write has been denied.
• The denial holds under --dangerously-skip-permissions (verified: a control run without the skill wrote a probe file; with the skill active the same Write was denied and no file was created). That part is great — it behaves like a deny rule.

Workaround

Run skills carrying disallowed-tools in default or plan mode; avoid auto-accept while such a skill is active.

---

Authoring disclosure: investigated and written in a Claude Code session (Claude Fable 5, CLI 2.1.220) with live control/probe runs as described; reviewed and submission approved by the account owner.