{
  "id": 18385848,
  "title": "Before you open Claude Code in a cloned repo, check its .claude/skills folder",
  "url": "https://urgent.news/2026/11/05/before-you-open-claude-code-in-a-cloned-repo-check-its-claude-skills",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-05T22:21:51.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/adrian2016/before-you-open-claude-code-in-a-cloned-repo-check-its-claudeskills-folder-1o0e"
  },
  "original_language": "en",
  "account": "Before opening a cloned repository that includes Claude Code, it is essential to check the .claude/skills/ folder. This folder contains project skills that run without requiring a permission prompt during their use. When reviewing these skills, pay close attention to the allowed-tools line for each skill, looking for the presence of '!'. Commands listed with '!' are executed when the skill loads, even before Claude processes the input.\n\nIn a cloned repository, skills with broad permissions are particularly noteworthy. About 94.3% of the analyzed skills have no restrictions on the commands they can run. Additionally, 12.5% of skills are configured to allow any Bash command, 6.4% permit only specific Bash commands, and 5.0% allow Write or Edit actions. Furthermore, 2.8% of skills initiate commands during the loading process.\n\nOne common scenario is when a project skill shares its name with a built-in command or a bundled skill, causing it to replace the original command in the terminal session. In such cases, the skill's version of the command will execute whenever the corresponding command is typed. A majority of these skills (29.5%) are mere scripts, while 10.9% are designed to run on external servers.\n\nAmong the top coincidences where a common review command (such as review, code-review, or security-review) leads to the execution of a skill written by the repository's author, there are 16.4% of repositories that contain one of these skills at the root level. The most frequently found names are verify, review, code-review, debug, and plan. These skills are typically custom review workflows created by the repository's author and may include pre-approval of Bash commands.\n\nThroughout the analysis of 2,427 repositories, 41,142 skills were examined. Hidden characters were also scrutinized, with a focus on zero-width characters, direction-changing characters, Unicode tag characters, and HTML comments. While most hidden characters were benign, such as emoji joiners and escape sequences, one instance was found that could potentially hide instructions. This particular skill also permitted Bash commands, emphasizing the importance of closely examining project skills before opening a cloned repository.",
  "summary": "Before you open Claude Code in a repo you cloned, look inside its .claude/skills/ folder. Read the allowed-tools line of each skill, search for !` , and compare the folder names with the commands you plan to type. The reason is simple. A project skill comes with the repo, and three things about it don't depend on whether you trust the folder: Pre-approved tools. Whatever a skill lists in…",
  "key_points": [
    ".claude/skills/ folder contains project skills without permission prompts",
    "94.3% of analyzed skills have no command restrictions in cloned repos",
    "Review skills with \"!\" prefix to identify pre-execution commands"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}