Skill arguments are substituted into `$<digit>` sequences in SKILL.md, corrupting the xlsx skill's absolute-reference examples

## Summary

When a skill is invoked with arguments, the loader replaces `$` followed by a single digit `0–9` followed by a non-word character with the Nth whitespace-delimited argument token (0-indexed).

The on-disk `SKILL.md` is untouched — the substitution happens in the text delivered to the model — so the corruption is invisible to file inspection. I verified `skills/xlsx/SKILL.md` in this repo is byte-correct; only the injected copy is affected.

This hits the xlsx skill because its Excel absolute references (`$B$2`, `$B$5`, `$B$6`) all end in `$` + digit.

## Reproduction

Invoke the xlsx skill with ten argument words:

```
ZERO ONE TWO THREE FOUR FIVE SIX SEVEN EIGHT NINE
```

Observed in the text delivered to the model:

| Source (`skills/xlsx/SKILL.md`) | Delivered to the model |
|---|---|
| `='[1]Returns Analysis'!$B$2` | `='[1]Returns Analysis'!$BTWO` |
| `='Assumptions Inputs'!$B$5` | `='Assumptions Inputs'!$BFIVE` |
| `=B5*(1+$B$6)` | `=B5*(1+$BSIX)` |

## The rule

Confirmed with a controlled test on a second, unrelated skill using the same ten markers:

| Literal | Result | Why |
|---|---|---|
| `$2,500` | `TWO,500` | comma is a word boundary |
| `$2.5K` | `TWO.5K` | period is a boundary too |
| `$0 paid` | `ZERO paid` | space is a boundary |
| `$5K` | unchanged | `K` is a word character — no boundary |
| `$10,000` | unchanged | `$1` is followed by `0` — no boundary |
| `$9,999` with only 3 args | unchanged | index beyond the supplied arguments |

So the trigger is `\$([0-9])(?![0-9A-Za-z_])`, and it stays hidden until someone passes a long enough argument string to make the index resolve.

## Impact

**xlsx specifically:** the guidance on anchoring references is nonsense as delivered, and `$BTWO` is not a valid reference — a model reading it may copy that form into a real workbook.

**More broadly**, this silently rewrites any skill whose text contains:

- a currency amount with a single leading digit and a thousands separator — `$2,500`, `$5,000`, `$1,000` (very common in any skill that discusses money)
- a bare `$0`
- Postgres bind parameters in example SQL — `WHERE id = $1`
- shell positional parameters in example scripts — `"$1"`, `"$2"`

## Notes on workarounds

- **Backslash escaping does not help** — `\$2,500` still contains the `$2` substring.
- The only content-side workaround is to ensure the digit is immediately followed by another word character (`$2500`, `$10,000`, `$5K`), or to drop the sign entirely for `$0`. That is an awkward constraint to place on skill authors, and it silently breaks legitimate `$1`/`$2` bind parameters, which cannot be rewritten that way without changing their meaning.
- The fix likely belongs in the loader: either don't substitute at all, or require an explicit, unambiguous placeholder syntax that cannot collide with currency and SQL/shell parameter references.

## Environment

Claude Desktop · `anthropic-skills` plugin v1.0.0 · macOS 15.6

Start by locating the loader that substitutes argument tokens into skill text, then reproduce the issue with the ten words shown and compare the delivered content with skills/xlsx/SKILL.md. Trace the same behavior in the controlled second-skill example. Done means literal Excel references, currency values, SQL parameters, and shell parameters remain unchanged, with regression coverage for the substitution boundary cases.

Escrito por el modelo de indexación a partir del texto del issue.