If you are cloning a repository and firing up Claude Code, stop. Check the .claude/skills/ folder first. New research from Adrian Vale at AgentCraft reveals that project skills bundled with repos can execute shell commands, modify files, and override built-in commands without ever asking for your permission. The core issue is that workspace trust does not gate a skill's allowed-tools in any session. If the repo author listed Bash in their skill configuration, that command runs immediately when the skill activates.

The Mechanism of Silent Execution

The study analyzed 2,427 active public repositories, reading 41,142 individual skill files. The findings are stark: 97.9% of these repos ship skills that Claude can invoke on its own because they lack the disable-model-invocation flag. Furthermore, 12.6% of repos contain skills that pre-approve any Bash command. This means a malicious or poorly written skill can run arbitrary shell commands in your environment the moment Claude decides to use it. Even more concerning, 2.8% of skills use the ! syntax to run commands during the skill loading phase, before Claude even reads the skill description.

Command Hijacking and Name Clashes

A subtle but dangerous vector is name collision. 16.4% of the sampled repos contain a root-level skill named similarly to a built-in command or bundled skill, such as review, code-review, or debug. In a local terminal session, the project skill replaces the built-in command. If you type /code-review, you are not running Anthropic’s standard review; you are running the repo author’s custom workflow, which may include pre-approved Bash commands or file edits. The docs explicitly confirm this behavior: "A project code-review skill replaces /code-review."

Hidden Characters and Injection Vectors

Beyond obvious tool permissions, the research looked for invisible threats. While Claude Code version 2.1.299 started refusing skills with hidden direction-changing characters, other tricks remain. The study found 26 instances of zero-width characters, mostly harmless emoji joiners, but also one file containing Unicode tag characters that hide instructions invisible to the human eye. This specific instance appeared in a skill that also pre-approved Bash commands, demonstrating that prompt injection via invisible text is a live technique in public repos today.

How to Protect Your Session

To audit a repo before working in it, run ls .claude/skills/ and inspect every SKILL.md file. Look specifically for the allowed-tools frontmatter. A bare Bash entry is a red flag for any cloned repo. Also, search for the ! character, which indicates commands that run on load. For a safer one-off look, use claude -p --bare for headless runs, which ignores project hooks, skills, and plugins, or use --setting-sources user to skip project-specific settings.

Key Takeaways

  • 97.9% of sampled repos ship skills that Claude can invoke autonomously.
  • 12.6% of repos contain skills that pre-approve any Bash command without prompts.
  • 16.4% of repos have skill names that clash with built-in commands, hijacking your input.
  • Workspace trust does not prevent project skills from running allowed tools.
  • Use claude -p --bare to inspect repos without loading project-specific skills or hooks.

The Bottom Line

Workspace trust is not a security boundary for project skills. Always audit .claude/skills/ before interacting with cloned repositories, and use claude -p --bare for a safe initial inspection.