Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix [BUG] allowed-tools in skill SKILL.md only auto-approves the first Bash call per session, subsequent calls prompt for permission [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#60515•Fetched 2026-05-20 03:56:35
View on GitHub
Comments
1
Participants
2
Timeline
8
Reactions
0
Author
ppitonakppitonak
Participants
github-actions[bot]github-actions[bot]ppitonakppitonak
Timeline (top)
labeled ×6commented ×1subscribed ×1

Error Message

Error Messages/Logs

Code Example



---

> run script_a on item-1

  Skill loaded · 3 tools allowed
  Bash(/home/user/.claude/plugins/cache/my-plugin/0.1.0/skills/my-analyzer/scripts/script_a.sh item-1 --human)
  ⎿ runs successfully, no prompt

  > now run script_b on item-2

  Bash(/home/user/.claude/plugins/cache/my-plugin/0.1.0/skills/my-analyzer/scripts/script_b.sh item-2)
  ⎿ This command requires approval   ← unexpected

---

> run script_b on item-2

  Skill loaded · 3 tools allowed
  Bash(/home/user/.claude/plugins/cache/my-plugin/0.1.0/skills/my-analyzer/scripts/script_b.sh item-2)
  ⎿ runs successfully, no prompt

  > now run script_a on item-1

  Bash(/home/user/.claude/plugins/cache/my-plugin/0.1.0/skills/my-analyzer/scripts/script_a.sh item-1 --human)
  ⎿ This command requires approval   ← unexpected

---

> run script_a on item-1

  Skill loaded · 3 tools allowed
  Bash(.../scripts/script_a.sh item-1 --human)
  ⎿ Interrupted by user

  > run script_a on item-2

  Bash(.../scripts/script_a.sh item-2 --human)
  ⎿ This command requires approval   ← unexpected

---

---
name: my-analyzer
description: Analyze test failures using custom scripts.
allowed-tools: Bash(*/my-analyzer/scripts/script_a.sh *),Bash(*/my-analyzer/scripts/script_b.sh *),Bash(*/tools/*/install.sh *)
  ---
RAW_BUFFERClick to expand / collapse

Preflight Checklist

  • I have searched existing issues and this hasn't been reported yet
  • This is a single bug report (please file separate reports for different bugs)
  • I am using the latest version of Claude Code

What's Wrong?

A plugin skill declares multiple allowed-tools patterns in its SKILL.md frontmatter. When the skill is loaded, it correctly reports "3 tools allowed". However, only the first Bash command in a session is auto-approved — all subsequent Bash calls prompt for manual permission, even when using the exact same script and pattern.

What Should Happen?

All Bash calls matching allowed-tools patterns should be auto-approved for the duration of the skill's activation, not just the first one.

Error Messages/Logs

Steps to Reproduce

  1. Install plugin with the skill above. Start Claude Code with a fresh ~/.claude and ~/.claude.json (no saved permissions).
  2. Test 1 — first script runs, second prompts:
> run script_a on item-1

Skill loaded · 3 tools allowed
Bash(/home/user/.claude/plugins/cache/my-plugin/0.1.0/skills/my-analyzer/scripts/script_a.sh item-1 --human)
⎿ runs successfully, no prompt

> now run script_b on item-2

Bash(/home/user/.claude/plugins/cache/my-plugin/0.1.0/skills/my-analyzer/scripts/script_b.sh item-2)
⎿ This command requires approval   ← unexpected
  1. Test 2 — order reversed, same result (fresh container):
> run script_b on item-2

Skill loaded · 3 tools allowed
Bash(/home/user/.claude/plugins/cache/my-plugin/0.1.0/skills/my-analyzer/scripts/script_b.sh item-2)
⎿ runs successfully, no prompt

> now run script_a on item-1

Bash(/home/user/.claude/plugins/cache/my-plugin/0.1.0/skills/my-analyzer/scripts/script_a.sh item-1 --human)
⎿ This command requires approval   ← unexpected
  1. Test 3 — same script, different args (fresh container):
> run script_a on item-1

Skill loaded · 3 tools allowed
Bash(.../scripts/script_a.sh item-1 --human)
⎿ Interrupted by user

> run script_a on item-2

Bash(.../scripts/script_a.sh item-2 --human)
⎿ This command requires approval   ← unexpected

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

2.1.144

Platform

Google Vertex AI

Operating System

Other Linux

Terminal/Shell

Non-interactive/CI environment

Additional Information

SKILL.md frontmatter:

---
name: my-analyzer
description: Analyze test failures using custom scripts.
allowed-tools: Bash(*/my-analyzer/scripts/script_a.sh *),Bash(*/my-analyzer/scripts/script_b.sh *),Bash(*/tools/*/install.sh *)
  ---

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#installation#tensor shape#autograd error#model save/load#optimization

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

claude-code - 💡(How to fix) Fix [BUG] allowed-tools in skill SKILL.md only auto-approves the first Bash call per session, subsequent calls prompt for permission [1 comments, 2 participants]