Build1 publisher3 min readPublished
A forked Claude Code skill ran cat CLAUDE.md to reach the secret its prompt withheld
Three near-identical skills on Claude Code v2.1.263 show that context: fork isolates the conversation and leaves the filesystem alone, because the subagent still holds Read and Bash, at roughly five times the token cost.
The Engineer · Build desk
What happened
- A dev.to measurement post planted the codeword PINEAPPLE-42 inside a Claude Code session and the passphrase ORCHID-77 in CLAUDE.md, then resumed that session by id to invoke three skills differing only in frontmatter.
- The inline skill returned both secrets and listed the parent session's eleven tools.
- Both forked variants returned UNKNOWN for the codeword, matching the documentation line that a forked skill has no access to your conversation history.
- The Explore fork, the variant the docs exclude from loading CLAUDE.md, ran cat CLAUDE.md itself and answered the passphrase anyway.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint The isolation on offer covers conversation history only; a secret that lives in a file stays reachable by a subagent that can shell out and read it.
- decision Anyone treating the frontmatter line as a sandbox has to pick a different control, because the documented table governs prompt assembly rather than file access.
- cost The fivefold premium is charged on every forked call, so a skill invoked dozens of times a day turns an isolation preference into a recurring token bill.
- exposure Forking widened the skill's verb set instead of narrowing it, which makes the supposedly isolated path the more privileged one.
The line item the doc table does not carry is authority. Inline, the skill listed eleven tool names [7]. The general-purpose fork listed ten and then "(69 more names)" [8], which is seventy-nine [16], about seven times the inline surface [17]. Fork a skill to isolate it and you hand it a wider verb set than the conversation it was forked out of. Explore points the other way: six names, plus deferred tools loadable through ToolSearch [9], so six is the starting set rather than the ceiling.
Two of those six are Bash and Read [9]. That is the whole of the Explore result. The skills reference says the forked subagent loads CLAUDE.md except when the agent is Explore or Plan [11], and the Explore fork's prompt behaved accordingly, but the transcript shows it ran `cat CLAUDE.md` [10] and returned ORCHID-77 [9]. A file kept out of the prompt is not a file kept out of reach: the subagent still had Bash and Read, and it used them to get to the secret directly. The lab's own CLAUDE.md named both routes to the passphrase: be a context with the file loaded, or be an agent that goes and reads it [18]. Explore took the second.
The general-purpose fork took neither route visibly, which is the cleanest evidence in the post. Its transcript, stored under the session's `subagents/` directory, holds exactly one user message (the rendered skill, prefixed with the skill's base directory) and one assistant message, with no `tool_use` blocks at all [13]. It knew ORCHID-77 because CLAUDE.md was in its prompt, exactly as the table describes [11]. The author's reading is that all three rows hold, two of them directly and Explore only once you open the transcript [15].
Then the bill: about five times inline per invocation [14]. For that ratio to transfer, your parent conversation has to look like this one, a session carrying a single planted exchange and resumed by id [4]. Fork cost is dominated by items that do not shrink, the agent system prompt and seventy-nine tool definitions [16][11]. Inline cost grows with whatever conversation you are pasting the skill into. On a session with real history, the ratio should move toward inline being the expensive call, which is inference from the setup rather than something the post measured.
What the measurement earns is narrow and useful. One run, one version, v2.1.263, one throwaway directory [2]. The docs were accurate about what they set out to describe, which is how the subagent's prompt gets assembled [11][12], and that description covers what goes into the prompt, not what the subagent can retrieve once it starts calling tools. If a skill must not see a secret, the controls that matter are the subagent's tool set and the contents of the directory it can read.
What to watch
- Whether the skills reference starts documenting the forked subagent's tool surface, not only how its prompt is assembled.
- A rerun on a later Claude Code build, since the 79-name fork surface is a v2.1.263 observation from one directory.
- Any frontmatter option that scopes a forked subagent's Read and Bash to a subdirectory rather than the whole project.