Project-level skills in .claude/skills/ are now uneditable — protection conflicts with core feature design

[soliblue]

Environment

• Claude Code version: 2.1.78
• OS: macOS
• Permission mode: bypassPermissions (with Write(.claude/**) and Edit(.claude/**) in allow rules)

Problem

v2.1.77/2.1.78 hardcoded .claude/ as a protected directory, blocking Write and Edit tool calls even when:

• The user has defaultMode: bypassPermissions in global settings
• The user has explicit Write(.claude/**) and Edit(.claude/**) allow rules in settings.local.json

This creates a direct conflict with Claude Code's own feature design. Project-level skills are supposed to live at .claude/skills/ — this is documented, first-class behavior. But now Claude cannot create or edit them without triggering a prompt that has no override.

The contradiction

The docs say:

Skills extend what Claude can do. Create a SKILL.md file with instructions...
Project skills: .claude/skills/<skill-name>/SKILL.md — This project only.

But Claude can no longer write to .claude/skills/ autonomously, even with explicit user consent via allow rules. The protection defeats the intended workflow entirely.

What makes this worse

Write(.claude/**) and Edit(.claude/**) in permissions.allow have no effect. The user explicitly said "allow writes to .claude/" and Claude Code ignores it. If allow rules can't override this, what are they for?

The only workaround is piping through Bash (sed, cat >) — which is less auditable than a Write tool call and harder for the user to review. The protection is actively pushing the operation into a less visible channel.

Specific use case

I run plans (lightweight ticket files) at .claude/plans/ and skills at .claude/skills/. Every session involves creating, editing, and moving these files. Since 2.1.77, every one of these operations now requires manual approval — in a session where I've already granted blanket permission.

The workaround is moving plans to a plans/ directory at the repo root, which I'm doing. But .claude/skills/ has no equivalent escape hatch — skills are designed to live there.

Proposed fix

Honour explicit allow rules. If a user adds Write(.claude/**) to their allow list, that should be treated as consent. The protection should be a default that explicit allow rules can override — not a hardcoded wall that ignores the permission system entirely.

Alternatively, scope the protection to the files that actually matter: settings.json, settings.local.json, hooks/. Not the entire .claude/ tree including skills, plans, and other user-created content.

Related

• [BUG] v2.1.78: Protected directory prompt in bypassPermissions has no override — forces hacky workarounds #35646 — same root cause from the bypass mode angle
• [Feature Request] Add setting to skip protected directory prompts when bypassPermissions is enabled #35942 — feature request for opt-in override

[interconnectedMe]

skill-creator runs (think that was it...) earlier today drove me bonkers.
Then Claude lost everything from a 5 skill run inside a worktree that got deleted following the task anyway, apart from the percentage headline numbers...I'll pick that up again next week, and maybe the .claude popup whackamole will have abated.

[yurukusa]

A PreToolUse hook can override the protection for specific paths:

INPUT=$(cat)
FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
if echo "$FILE" | grep -qE '\.claude/(skills|agents|settings|CLAUDE)'; then
    echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"Explicit allow for .claude/ project files"}}'
    exit 0
fi
exit 0

Add to your global ~/.claude/settings.json:

{
  "hooks": {
    "PreToolUse": [{
      "matcher": "Edit|Write",
      "hooks": [{ "type": "command", "command": "bash ~/.claude/hooks/allow-claude-dir-writes.sh" }]
    }]
  }
}

This hook fires before the built-in protection check and explicitly allows writes to .claude/skills/, .claude/agents/, etc. The hook's permissionDecision: allow overrides the hardcoded protection.
You can also scope it per-project by putting the hook in .claude/settings.json at project root instead of globally.

[github-actions]

Closing for now — inactive for too long. Please open a new issue if this is still relevant.

[github-actions]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.