allowed-tools wildcards in SKILL.md permit broader matches than intended

[vindon]

Describe your idea or feedback

Goal: install and use the Langfuse skill for LLM tracing in a Python pipeline (Claude/Gemini/NVIDIA NIM).
▎
▎ The skill's allowed-tools frontmatter pre-authorizes several Bash patterns without per-call approval:
▎ Bash(curl langfuse.com/)
▎ Bash(npx langfuse-cli api __schema *)
▎ Bash(npx langfuse-cli api * --help *)
▎ Bash(npx langfuse-cli api * list *)
▎ Bash(npx langfuse-cli api * get *)
▎ (plus the bunx equivalents)
▎
▎ Bash(curl langfuse.com/) has a wildcard on both sides, so it matches any command containing the substring langfuse.com/ anywhere — not just a request to that host. For example curl https://pastebin.com/x?ref=langfuse.com/ would satisfy this pattern. Every actual curl invocation in the skill's own docs is anchored (curl -s https://langfuse.com/... or curl -s "https://langfuse.com/..."), so the pattern doesn't need to be this broad.
▎
▎ Separately — not something I could verify — the npx/bunx langfuse-cli api ... --help/list/get * patterns have wildcards in the middle of the command. Whether Claude Code's pattern matcher can be tricked into matching a command containing shell-chaining operators (;, &&, $()) inside that wildcard is outside what I could confirm from this environment; flagging so it can be checked against the actual permission-matching semantics.

What would the ideal outcome look like?

What would the ideal outcome look like?

▎ Anchor the curl pattern to the literal prefix actually used, e.g. Bash(curl -s https://langfuse.com/*), and confirm/document whether the npx/bunx mid-string wildcards are safe against shell metacharacter injection.

Target: langfuse skill, SKILL.md (allowed-tools frontmatter)