Before you open Claude Code in a cloned repo, check its .claude/skills folder

Before opening a cloned repository that includes Claude Code, it is essential to check the .claude/skills/ folder. This folder contains project skills that run without requiring a permission prompt during their use. When reviewing these skills, pay close attention to the allowed-tools line for each skill, looking for the presence of '!'. Commands listed with '!' are executed when the skill loads, even before Claude processes the input.

In a cloned repository, skills with broad permissions are particularly noteworthy. About 94.3% of the analyzed skills have no restrictions on the commands they can run. Additionally, 12.5% of skills are configured to allow any Bash command, 6.4% permit only specific Bash commands, and 5.0% allow Write or Edit actions. Furthermore, 2.8% of skills initiate commands during the loading process.

One common scenario is when a project skill shares its name with a built-in command or a bundled skill, causing it to replace the original command in the terminal session. In such cases, the skill's version of the command will execute whenever the corresponding command is typed. A majority of these skills (29.5%) are mere scripts, while 10.9% are designed to run on external servers.

Among the top coincidences where a common review command (such as review, code-review, or security-review) leads to the execution of a skill written by the repository's author, there are 16.4% of repositories that contain one of these skills at the root level. The most frequently found names are verify, review, code-review, debug, and plan. These skills are typically custom review workflows created by the repository's author and may include pre-approval of Bash commands.

Throughout the analysis of 2,427 repositories, 41,142 skills were examined. Hidden characters were also scrutinized, with a focus on zero-width characters, direction-changing characters, Unicode tag characters, and HTML comments. While most hidden characters were benign, such as emoji joiners and escape sequences, one instance was found that could potentially hide instructions.

This particular skill also permitted Bash commands, emphasizing the importance of closely examining project skills before opening a cloned repository.