From b7d2ad5589aa895b19911a1f008ba596adb15063 Mon Sep 17 00:00:00 2001
From: Abdul Wahab <32850166+abdulwahabone@users.noreply.github.com>
Date: Fri, 26 Jun 2026 09:16:32 +0900
Subject: [PATCH] Fix: allow skill's bundled node helpers under
 strict-permission harnesses (#301) (#310)

The skill declared only `Bash(npx impeccable *)` in allowed-tools, but Setup and the no-arg menu shell out to `node {{scripts_path}}/*.mjs`. Under a default-deny Claude Code allowlist those calls are blocked, so Setup fails on context.mjs.

Add a provider-aware `Bash(node {{scripts_path}}/*)` entry and resolve {{scripts_path}} in the frontmatter (the build previously substituted it only in the body). Provider-aware rather than the hardcoded `.claude/...` path the issue suggested, since five providers honor allowed-tools with different script dirs.
---
 scripts/lib/transformers/factory.js | 2 +-
 skill/SKILL.src.md                  | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/lib/transformers/factory.js b/scripts/lib/transformers/factory.js
index ada60892e..aad979210 100644
--- a/scripts/lib/transformers/factory.js
+++ b/scripts/lib/transformers/factory.js
@@ -235,7 +235,7 @@ export function createTransformer(config) {
       skillBody = skillBody.replace(/\{\{scripts_path\}\}/g, scriptsPath);
       if (bodyTransform) skillBody = bodyTransform(skillBody, skill);
 
-      const content = `${frontmatter}\n\n${skillBody}`;
+      const content = `${frontmatter}\n\n${skillBody}`.replace(/\{\{scripts_path\}\}/g, scriptsPath);
       writeFile(path.join(skillDir, 'SKILL.md'), content);
 
       if (writeOpenAIMetadata) {
diff --git a/skill/SKILL.src.md b/skill/SKILL.src.md
index 30778142d..5ac2672b6 100644
--- a/skill/SKILL.src.md
+++ b/skill/SKILL.src.md
@@ -5,6 +5,7 @@ argument-hint: "[{{command_hint}}] [target]"
 user-invocable: true
 allowed-tools:
   - Bash(npx impeccable *)
+  - Bash(node {{scripts_path}}/*)
 license: Apache 2.0
 ---