diff --git a/config/opencode/skills/ask-claude/SKILL.md b/config/opencode/skills/ask-claude/SKILL.md
index cf5d8a1..9b0afde 100644
--- a/config/opencode/skills/ask-claude/SKILL.md
+++ b/config/opencode/skills/ask-claude/SKILL.md
@@ -5,9 +5,9 @@ description: Consult Claude (Anthropic's flagship model, Opus-class) as an oracl
 
 # Ask Claude
 
-Run `claude -p "<prompt>"` via the `bash` tool to get a one-shot answer from
-Claude. Claude is significantly more capable at reasoning, code review, and
-architectural judgment than smaller models — when you are not sure, ask.
+Run `claude -p -- "<prompt>"` via the `bash` tool to get a one-shot answer
+from Claude. Claude is significantly more capable at reasoning, code review,
+and architectural judgment than smaller models — when you are not sure, ask.
 
 ## When to use
 
@@ -22,24 +22,53 @@ anything you are already confident about — calls cost money and time.
 
 ## Basic invocation
 
+Always use this shape: `-p` first, all flags next, then `--`, then the
+prompt as a single positional argument.
+
 ```bash
-claude -p "Your question here, with all relevant context inline."
+claude -p -- "Your question here, with all relevant context inline."
 ```
 
 The prompt should be **self-contained** — Claude starts with no memory of this
 conversation. Include the file paths, code snippets, error messages, and
 what you have already tried.
 
+### Always use `--` before the prompt
+
+Several flags accepted by `claude` are **variadic** and will silently swallow
+your prompt as if it were another value:
+
+- `--allowedTools <tools...>`
+- `--disallowedTools <tools...>`
+- `--add-dir <directories...>`
+- `--tools <tools...>`
+- `--betas <betas...>`
+
+Without `--`, the trailing prompt becomes the last "tool" (or directory, or
+beta header) and `claude` exits with `Input must be provided either through
+stdin or as a prompt argument when using --print`.
+
+```bash
+# BROKEN — "Review the changes…" parsed as a tool name
+claude -p --allowedTools "Read Grep Glob" "Review the changes…"
+
+# CORRECT — `--` terminates option parsing, the prompt is the lone positional
+claude -p --allowedTools "Read Grep Glob" -- "Review the changes…"
+```
+
+Use `--` even when no variadic flag is in play. It is harmless when
+unnecessary and removes a whole class of foot-guns.
+
 ## Piping context via stdin
 
 For longer context (a file, a diff, log output), pipe it in:
 
 ```bash
-cat path/to/file.rs | claude -p "Review this for race conditions; explain any you find."
+cat path/to/file.rs | claude -p -- "Review this for race conditions; explain any you find."
 ```
 
 ```bash
-git diff main...HEAD | claude -p "Spot bugs or risky changes in this diff."
+git diff main...HEAD | claude -p -- "Spot bugs or risky changes in this diff."
 ```
 
 Only pipe when the context is small and self-contained. For anything that
@@ -59,9 +88,9 @@ Recommended invocation, run from the repo root:
 ```bash
 claude -p --permission-mode dontAsk \
   --allowedTools "Read Grep Glob Bash(git diff:*) Bash(git log:*) Bash(git status:*) Bash(git show:*)" \
-  "Review the changes on this branch vs main. Flag bugs, risky changes,
-   and anything that violates the project's conventions. Read whatever
-   files you need for context."
+  -- "Review the changes on this branch vs main. Flag bugs, risky changes,
+      and anything that violates the project's conventions. Read whatever
+      files you need for context."
 ```
 
 Why this is better than `git diff … | claude -p`:
@@ -92,16 +121,16 @@ entry can carry a permission spec in parentheses to narrow the scope.
 
 ```bash
 # Read-only project access — the most common upgrade
-claude -p --allowedTools "Read Grep Glob" "..."
+claude -p --allowedTools "Read Grep Glob" -- "..."
 
 # Allow only specific bash subcommands
-claude -p --allowedTools "Read Grep Glob Bash(git diff:*) Bash(git log:*)" "..."
+claude -p --allowedTools "Read Grep Glob Bash(git diff:*) Bash(git log:*)" -- "..."
 
 # Allow web fetches, but only to one domain
-claude -p --allowedTools "WebFetch(domain:docs.python.org)" "..."
+claude -p --allowedTools "WebFetch(domain:docs.python.org)" -- "..."
 
 # Block one tool, allow the rest of the defaults
-claude -p --disallowedTools "Bash" "..."
+claude -p --disallowedTools "Bash" -- "..."
 ```
 
 Spec syntax cheatsheet:
@@ -136,10 +165,10 @@ Sets the default behaviour for anything not covered by allow/disallow:
 # Strict deny-by-default with an explicit allowlist (recommended for -p)
 claude -p --permission-mode dontAsk \
   --allowedTools "Read Grep Glob" \
-  "Audit error handling in src/auth/."
+  -- "Audit error handling in src/auth/."
 
 # Plan mode for a design review — Claude reads, thinks, won't touch anything
-claude -p --permission-mode plan "Propose a refactor for X."
+claude -p --permission-mode plan -- "Propose a refactor for X."
 ```
 
 ### `--add-dir`
@@ -150,7 +179,7 @@ the question spans repos:
 ```bash
 claude -p --allowedTools "Read Grep Glob" \
   --add-dir ../other-repo --add-dir /etc/nixos \
-  "Compare how both projects handle config loading."
+  -- "Compare how both projects handle config loading."
 ```
 
 ### `--dangerously-skip-permissions`