{"slug": "before-you-open-claude-code-in-a-cloned-repo-check-its-claude-skills-folder", "title": "Before you open Claude Code in a cloned repo, check its .claude/skills folder", "summary": "An analysis of 2,427 active public repositories found that 97.9% ship a project skill Claude Code can invoke on its own, and 22.3% include skills with `allowed-tools` that pre-approve commands without a permission prompt. About 12.6% of repos contain a skill that pre-approves any Bash command, and 153 repos (roughly one in sixteen) have a root-level skill named `review`, `code-review` or `security-review` that runs when a developer types that command. The researcher recommends inspecting a cloned repo's `.claude/skills/` folders, their `allowed-tools` lines and any `` !` `` load-time commands before opening Claude Code in it.", "body_md": "Before you open Claude Code in a repo you cloned, look inside its `.claude/skills/` folder. Read the `allowed-tools` line of each skill, search for `` !` ``, and compare the folder names with the commands you plan to type.\n\nThe reason is simple. A project skill comes with the repo, and three things about it don't depend on whether you trust the folder:\n\n`allowed-tools` runs without a permission prompt during the turn that uses it. The docs put it plainly: \"Workspace trust never gates a skill's `` !` git status` `` runs while the skill loads, before Claude reads it, with no prompt when your permission rules or the skill's `code-review` skill replaces `/code-review`.\"\nAnd Claude can use most of these skills on its own. 98% of the repos we read ship a project skill without `disable-model-invocation`, so Claude may load it whenever a request matches its description.\n\nSo how common are these in practice? We read every project skill in 2,427 active public repos.\n\n`ls .claude/skills/` at the repo root, plus any nested `.claude/skills/` folders. If a folder is named like a command you use, such as `review`, `security-review`, `verify` or `debug`, read that skill first. Typing the command will run the repo's version.`Bash` means any shell command runs without asking during that turn. `Bash(git status *)` allows only that command. Also look for `Write`, `Edit` and `WebFetch`.`` !` ``.` git` state; read the ones that do more.`claude -p --bare`, which reads no hooks, skills, plugins or `.mcp.json` from the project. `--setting-sources user` skips the project's settings files and `filename:SKILL.md path:.claude/skills`. Search returns at most 1,000 results per query, so we split the search into 58 file-size slices and sampled 41 of them. The 22 smallest slices ran in order, and every other slice ran after that, so every size range is represented. That gave 31,272 unique files, about 6% of the total, from 16,304 repos.\n| What the repo ships | Repos (of 2,427) | Skills, max 10 per repo | All skills | \n|---|---|---|---|\n| A project skill Claude can invoke on its own | 97.9% | 94.3% | 95.3% | \n| A skill with `allowed-tools` | 22.3% | 12.5% | 10.6% | \n| A skill that pre-approves any Bash command | 12.6% | 6.4% | 5.8% | \n| A skill that pre-approves listed Bash commands only | 10.4% | 3.9% | 2.8% | \n| A skill that pre-approves Write or Edit | 11.5% | 5.0% | 4.9% | \n| A skill that runs a command on load ( `` !` `` ) | 2.8% | 0.8% | 0.6% | \n| A skill that does both: `` !` `` and any Bash | 0.5% | 0.1% | 0.1% | \n| A skill that runs a bundled script | 29.5% | 7.4% | 7.0% | \n| A skill whose script goes online | 10.9% | 1.6% | 1.6% | \n| A root-level skill named like a built-in command or bundled skill | 16.4% | 2.1% | 1.3% | \n| A root-level skill named `review` ,`code-review` or`security-review` | 6.3% | 0.7% | 0.4% | \n\nQuick guess: in how many of these repos does typing a common review command run something the repo's author wrote? 153 repos, about one in sixteen, have a root-level skill named `review`, `code-review` or `security-review`. Across all 399 repos with a clash, the most common names are `verify`, `review`, `code-review`, `debug` and `plan`. These look like ordinary names that happen to match. All 15 of the `review`, `code-review` and `security-review` skills we sampled are genuine review workflows. They are still the repo author's review, with the author's rules, and some pre-approve Bash. The point is the mechanism: the command you type runs the repo's skill.\n\nThe commands inside `` !` `` are mostly harmless reads: `git` (144 uses), `bash` (79), `gh` (36), `grep`, `find`, `cat` and `ls`. Five call `curl`.\n\nMost `allowed-tools: Bash` lines look like authors saving themselves prompts in their own workflow. That is reasonable in your own repo. In someone else's repo, it means their skill runs shell commands in your session without asking, for the turn that uses it.\n\nClaude Code started refusing skills whose folder names contain hidden, direction-changing or blank-like characters in 2.1.299 (October 14), and fixed other invisible-character problems in later releases. So we also looked for hidden text in the same 41,142 files:\n\n| What we looked for | Repos | Skills | \n|---|---|---|\n| Zero-width characters | 26 | 26 | \n| Direction-changing characters | 0 | 0 | \n| Unicode tag characters (invisible text) | 1 | 1 | \n| Folder names the 2.1.299 rule would refuse | 0 | 0 | \n| HTML comments over 40 characters, hidden when the file is rendered | 344 | 2,087 | \n| Such comments with \"ignore previous\" or \"secretly\" style wording | 1 | 1 | \n\nThe zero-width characters we read were harmless: emoji joiners and escapes inside nested code blocks. The one comment with hiding words is a prompt-injection example inside a security testing guide.\n\nThe one file with Unicode tag characters is different. It hides an instruction that a person reading the file cannot see, in a skill that also pre-approves Bash. The command it asks for is harmless, and it looks like a deliberate proof of concept. It shows the technique exists in a public repo today. We are not naming the repo. To check a repo for it, search its SKILL.md files for characters in the U+E0000 to U+E007F range.\n\nThe count of skills in a repo. A repo with hundreds of project skills can be harmless, and one skill with a bare `Bash` and a familiar name is worth more of your attention. Read the folder names and the frontmatter.\n\nThe counts above, in all three weightings, are in [project-skills-2026-11.json](https://agentcraft.dev/data/project-skills-2026-11.json). Repo and skill names are left out. To check a repo yourself, run the four checks above before you start Claude Code in it.\n\nFor skills you choose to install yourself, the [AgentCraft skills directory](https://agentcraft.dev/en/skills/) lists 5,101 Claude Code skills, and every community skill is reviewed before it's listed.\n\nThe full post is on AgentCraft: [https://agentcraft.dev/en/blog/claude-code-project-skills-2026-11/](https://agentcraft.dev/en/blog/claude-code-project-skills-2026-11/)\n\nDisclosure: I'm Adrian Vale and I help run AgentCraft.", "url": "https://wpnews.pro/news/before-you-open-claude-code-in-a-cloned-repo-check-its-claude-skills-folder", "canonical_source": "https://dev.to/adrian2016/before-you-open-claude-code-in-a-cloned-repo-check-its-claudeskills-folder-1o0e", "published_at": "2026-11-05 22:21:51+00:00", "updated_at": "2026-11-05 22:28:55.984415+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "ai-safety", "developer-tools"], "entities": ["Claude Code", "Anthropic", "GitHub"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/before-you-open-claude-code-in-a-cloned-repo-check-its-claude-skills-folder", "markdown": "https://wpnews.pro/news/before-you-open-claude-code-in-a-cloned-repo-check-its-claude-skills-folder.md", "text": "https://wpnews.pro/news/before-you-open-claude-code-in-a-cloned-repo-check-its-claude-skills-folder.txt", "jsonld": "https://wpnews.pro/news/before-you-open-claude-code-in-a-cloned-repo-check-its-claude-skills-folder.jsonld"}}