Before you open Claude Code in a repo you cloned, look inside its .claude/skills/ folder. Read the allowed-tools line of each skill, search for !`, and compare the folder names with the commands you plan to type.
The reason is simple. A project skill comes with the repo, and three things about it don't depend on whether you trust the folder:
allowed-tools runs without a permission prompt during the turn that uses it. The docs put it plainly: "Workspace trust never gates a skill's !` git status` runs while the skill loads, before Claude reads it, with no prompt when your permission rules or the skill's code-review skill replaces /code-review."
And Claude can use most of these skills on its own. 98% of the repos we read ship a project skill without disable-model-invocation, so Claude may load it whenever a request matches its description.
So how common are these in practice? We read every project skill in 2,427 active public repos.
ls .claude/skills/ at the repo root, plus any nested .claude/skills/ folders. If a folder is named like a command you use, such as review, security-review, verify or debug, read that skill first. Typing the command will run the repo's version.Bash means any shell command runs without asking during that turn. Bash(git status *) allows only that command. Also look for Write, Edit and WebFetch.!`. git state; read the ones that do more.claude -p --bare, which reads no hooks, skills, plugins or .mcp.json from the project. --setting-sources user skips the project's settings files and filename:SKILL.md path:.claude/skills. Search returns at most 1,000 results per query, so we split the search into 58 file-size slices and sampled 41 of them. The 22 smallest slices ran in order, and every other slice ran after that, so every size range is represented. That gave 31,272 unique files, about 6% of the total, from 16,304 repos.
| What the repo ships | Repos (of 2,427) | Skills, max 10 per repo | All skills |
|---|---|---|---|
| A project skill Claude can invoke on its own | 97.9% | 94.3% | 95.3% |
A skill with allowed-tools |
22.3% | 12.5% | 10.6% |
| A skill that pre-approves any Bash command | 12.6% | 6.4% | 5.8% |
| A skill that pre-approves listed Bash commands only | 10.4% | 3.9% | 2.8% |
| A skill that pre-approves Write or Edit | 11.5% | 5.0% | 4.9% |
A skill that runs a command on load ( !` ) |
2.8% | 0.8% | 0.6% |
A skill that does both: !` and any Bash |
0.5% | 0.1% | 0.1% |
| A skill that runs a bundled script | 29.5% | 7.4% | 7.0% |
| A skill whose script goes online | 10.9% | 1.6% | 1.6% |
| A root-level skill named like a built-in command or bundled skill | 16.4% | 2.1% | 1.3% |
A root-level skill named review ,code-review orsecurity-review |
6.3% | 0.7% | 0.4% |
Quick guess: in how many of these repos does typing a common review command run something the repo's author wrote? 153 repos, about one in sixteen, have a root-level skill named review, code-review or security-review. Across all 399 repos with a clash, the most common names are verify, review, code-review, debug and plan. These look like ordinary names that happen to match. All 15 of the review, code-review and security-review skills we sampled are genuine review workflows. They are still the repo author's review, with the author's rules, and some pre-approve Bash. The point is the mechanism: the command you type runs the repo's skill.
The commands inside !` are mostly harmless reads: git (144 uses), bash (79), gh (36), grep, find, cat and ls. Five call curl.
Most allowed-tools: Bash lines look like authors saving themselves prompts in their own workflow. That is reasonable in your own repo. In someone else's repo, it means their skill runs shell commands in your session without asking, for the turn that uses it.
Claude Code started refusing skills whose folder names contain hidden, direction-changing or blank-like characters in 2.1.299 (October 14), and fixed other invisible-character problems in later releases. So we also looked for hidden text in the same 41,142 files:
| What we looked for | Repos | Skills |
|---|---|---|
| Zero-width characters | 26 | 26 |
| Direction-changing characters | 0 | 0 |
| Unicode tag characters (invisible text) | 1 | 1 |
| Folder names the 2.1.299 rule would refuse | 0 | 0 |
| HTML comments over 40 characters, hidden when the file is rendered | 344 | 2,087 |
| Such comments with "ignore previous" or "secretly" style wording | 1 | 1 |
The zero-width characters we read were harmless: emoji joiners and escapes inside nested code blocks. The one comment with hiding words is a prompt-injection example inside a security testing guide.
The one file with Unicode tag characters is different. It hides an instruction that a person reading the file cannot see, in a skill that also pre-approves Bash. The command it asks for is harmless, and it looks like a deliberate proof of concept. It shows the technique exists in a public repo today. We are not naming the repo. To check a repo for it, search its SKILL.md files for characters in the U+E0000 to U+E007F range.
The count of skills in a repo. A repo with hundreds of project skills can be harmless, and one skill with a bare Bash and a familiar name is worth more of your attention. Read the folder names and the frontmatter.
The counts above, in all three weightings, are in project-skills-2026-11.json. Repo and skill names are left out. To check a repo yourself, run the four checks above before you start Claude Code in it.
For skills you choose to install yourself, the [AgentCraft skills directory](https://agentcraft.dev/en/skills/) lists 5,101 Claude Code skills, and every community skill is reviewed before it's listed.
The full post is on AgentCraft: [https://agentcraft.dev/en/blog/claude-code-project-skills-2026-11/](https://agentcraft.dev/en/blog/claude-code-project-skills-2026-11/)
Disclosure: I'm Adrian Vale and I help run AgentCraft.