[BUG] Built-in /security-review ends the turn when a skill invokes it mid-workflow, stalling the rest of the pipeline

Preflight Checklist

• [X] I have searched existing issues and this hasn't been reported yet
• [X] This is a single bug report (please file separate reports for different bugs)
• [X] I am using the latest version of Claude Code

What's Wrong?

I have a personal /implement skill that runs a full issue-to-PR pipeline: branch, TDD implementation, /code-review high --fix, then /security-review, then triage of findings, rebase, test, push and open the PR. It invokes security-review through the Skill tool as one step of that pipeline.

Almost every time, Claude writes the security report and then ends the turn. The rest of the pipeline never runs until I send "continue", and then it picks up exactly where it left off. This has been a recurring friction point for months.

The likely cause is the last line of the built-in prompt (present in the 2.1.284 binary):

Your final reply must contain the markdown report and nothing else.

That wording is right when a user types /security-review on its own. When a skill invokes it through the Skill tool, the prompt is injected mid-conversation as the most recent and most specific instruction. It also resets the role ("You are a senior security engineer conducting a focused security review..."). The model reads "final reply" as "end the turn", and that beats the calling skill's instructions to keep going.

/code-review high --fix runs one step earlier in the same pipeline, in the same sessions, and never stalls. Its prompt has no terminal instruction.

What Should Happen?

A built-in skill invoked through the Skill tool should hand control back to the calling workflow once its output is produced, not end the turn. Possible fixes:

• Scope the last line to the output, not the turn, e.g. "Your report must contain the markdown report and nothing else. If you were invoked as part of a larger task, continue with that task after the report."
• Or leave the "final reply" line out when the command is invoked through the Skill tool rather than typed by the user.

Error Messages/Logs

No error. The turn ends normally (stop_reason: end_turn), and the final assistant
message contains only the security report ("# Security review: ..."). Session
evidence is under Additional Information.

Steps to Reproduce

1. Write a personal skill that runs a multi-step pipeline and invokes security-review through the Skill tool partway through, with more steps after it (e.g. triage findings, run tests, push, open a PR).
2. Run it in the Claude desktop app (Code tab) on a feature branch with a real diff, in a normal working session. By the review step the conversation already holds the earlier phases (implementation, tests, code review).
3. Observe: the security report is printed and the turn ends. The steps after the review don't run.
4. Send "continue". The pipeline resumes at the next step.

Note: a stripped-down repro (a fresh 3-step skill in a tiny repo, run headless with claude -p) did NOT stall in 6 of 6 runs. The stall seems to need a real, longer pipeline session, which is how this skill is normally used.

Workaround: have the calling skill run the review in a subagent ("Invoke the security-review skill and return its report verbatim"). The "final reply" instruction then lands in the subagent, whose final reply is just the tool result, so the main turn keeps going.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.284 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Other

Additional Information

Environment: Claude desktop app (Code tab), using the Claude Code build bundled with the app (hence "Other" for the terminal). Also seen on 2.1.275, 2.1.280 and 2.1.281.

Session evidence. All runs were the same /implement pipeline, invoking security-review through the Skill tool:

| Date | Claude Code | Model | Result after the report | My next message |
|---|---|---|---|---|
| 2026-09-21 | 2.1.275 | Opus 5 | turn ended | "push it and open the PR" |
| 2026-09-21 | 2.1.275 | Opus 5 | continued through to the PR | - |
| 2026-09-24 | 2.1.280 | Opus 5.5 | turn ended | "continue" |
| 2026-09-25 | 2.1.281 | Opus 5.5 | turn ended | "Continue" |
| 2026-09-28 | 2.1.281 | Opus 5.5 | turn ended | "continue" |
| 2026-09-29 | 2.1.284 | Opus 5.5 | turn ended | "continue" |

5 of 6 runs stalled, and every stall ended on the report heading. In some stalled runs the review's sub-agent results came back inline; in the 2026-09-29 run they arrived as a separate sub-agent hand-back message. It stalled either way, so the delivery path doesn't seem to matter.

Related but distinct: #88437 (other content defects in built-in skills, including the security-review no-diff case).