Blog · 2026-11-06

Before you open Claude Code in a cloned repo, check its .claude/skills folder

We read 41,142 project-level Claude Code skills in 2,427 active public repos. 12.6% of repos ship a skill that pre-approves any Bash command, and 16.4% ship one named like a built-in command, which replaces it.

Summary

Before you open Claude Code in a repo you cloned, look inside its .claude/skills/ folder. Read the allowed-tools line of each skill, search for !`, and compare the folder names with the commands you plan to type.

The reason is simple. A project skill comes with the repo, and three things about it don’t depend on whether you trust the folder:

Pre-approved tools. Whatever a skill lists in allowed-tools runs without a permission prompt during the turn that uses it. The docs put it plainly: “Workspace trust never gates a skill’s allowed-tools in any session.”
Commands on load. A line like !`git status` runs while the skill loads, before Claude reads it, with no prompt when your permission rules or the skill’s allowed-tools allow it.
Same names. A project skill named like a built-in command or bundled skill replaces it in a local terminal session. The docs’ own example: “A project code-review skill replaces /code-review.”

And Claude can use most of these skills on its own. 98% of the repos we read ship a project skill without disable-model-invocation, so Claude may load it whenever a request matches its description.

So how common are these in practice? We read every project skill in 2,427 active public repos.

Our picks

What we now check before opening Claude Code in a repo we didn’t write:

List the skills. ls .claude/skills/ at the repo root, plus any nested .claude/skills/ folders. If a folder is named like a command you use, such as review, code-review, security-review, verify or debug, read that skill first. Typing the command will run the repo’s version.
Read allowed-tools. A bare Bash means any shell command runs without asking during that turn. Bash(git status *) allows only that command. Also look for Write, Edit and WebFetch.
Search for !`. Each one is a command that runs when the skill loads. Most just read git state; read the ones that do more.
For a one-off look, start without project content. For headless runs the docs suggest claude -p --bare, which reads no hooks, skills, plugins or .mcp.json from the project. --setting-sources user skips the project’s settings files and .mcp.json.

How we tested

Find project skills. GitHub code search reports 506,880 files matching filename:SKILL.md path:.claude/skills. Search returns at most 1,000 results per query, so we split the search into 58 file-size slices and sampled 41 of them. The 22 smallest slices ran in order, and every other slice ran after that, so every size range is represented. That gave 31,272 unique files, about 6% of the total, from 16,304 repos.
Filter repos. At least 5 stars, pushed to since October 7, not a fork, not archived: 2,435 repos. We read 2,427.
Read every project skill in those repos. From each repo’s file tree, every SKILL.md under .claude/skills/, plus the scripts each one names: 41,142 skills. We read them as text. Nothing was installed or run.
Weigh by repo. One repo holds 3,132 project skills and the median repo holds 7, so we report three numbers. The main one is the share of repos with at least one such skill, because that is what you meet when you clone. We also give the share of skills with at most 10 per repo, and the share of all 41,142 for comparison.

Results

What the repo ships	Repos (of 2,427)	Skills, max 10 per repo	All skills
A project skill Claude can invoke on its own	97.9%	94.3%	95.3%
A skill with `allowed-tools`	22.3%	12.5%	10.6%
A skill that pre-approves any Bash command	12.6%	6.4%	5.8%
A skill that pre-approves listed Bash commands only	10.4%	3.9%	2.8%
A skill that pre-approves Write or Edit	11.5%	5.0%	4.9%
A skill that runs a command on load (!`)	2.8%	0.8%	0.6%
A skill that does both: !` and any Bash	0.5%	0.1%	0.1%
A skill that runs a bundled script	29.5%	7.4%	7.0%
A skill whose script goes online	10.9%	1.6%	1.6%
A root-level skill named like a built-in command or bundled skill	16.4%	2.1%	1.3%
A root-level skill named `review`, `code-review` or `security-review`	6.3%	0.7%	0.4%

Quick guess: in how many of these repos does typing a common review command run something the repo’s author wrote? 153 repos, about one in sixteen, have a root-level skill named review, code-review or security-review. Across all 399 repos with a clash, the most common names are verify, review, code-review, debug and plan. These look like ordinary names that happen to match. All 15 of the review, code-review and security-review skills we sampled are genuine review workflows. They are still the repo author’s review, with the author’s rules, and some pre-approve Bash. The point is the mechanism: the command you type runs the repo’s skill.

The commands inside !` are mostly harmless reads: git (144 uses), bash (79), gh (36), grep, find, cat and ls. Five call curl.

Most allowed-tools: Bash lines look like authors saving themselves prompts in their own workflow. That is reasonable in your own repo. In someone else’s repo, it means their skill runs shell commands in your session without asking, for the turn that uses it.

Hidden characters

Claude Code started refusing skills whose folder names contain hidden, direction-changing or blank-like characters in 2.1.299 (October 14), and fixed other invisible-character problems in later releases. So we also looked for hidden text in the same 41,142 files:

What we looked for	Repos	Skills
Zero-width characters	26	26
Direction-changing characters	0	0
Unicode tag characters (invisible text)	1	1
Folder names the 2.1.299 rule would refuse	0	0
HTML comments over 40 characters, hidden when the file is rendered	344	2,087
Such comments with “ignore previous” or “secretly” style wording	1	1

The zero-width characters we read were harmless: emoji joiners and escapes inside nested code blocks. The one comment with hiding words is a prompt-injection example inside a security testing guide.

The one file with Unicode tag characters is different. It hides an instruction that a person reading the file cannot see, in a skill that also pre-approves Bash. The command it asks for is harmless, and it looks like a deliberate proof of concept. It shows the technique exists in a public repo today. We are not naming the repo. To check a repo for it, search its SKILL.md files for characters in the U+E0000 to U+E007F range.

What to ignore

The count of skills in a repo. A repo with hundreds of project skills can be harmless, and one skill with a bare Bash and a familiar name is worth more of your attention. Read the folder names and the frontmatter.

Limitations

A sample. About 6% of matching files, from active repos with 5 or more stars, as of November 6, 2026. Code search returns results by relevance within each slice, so this is not a random sample.
Static only. We read text with pattern rules and ran nothing. Rules miss commands built at runtime and can match commands quoted in documentation.
Capabilities, not intent. Almost everything here is authors configuring their own workflow. We counted what a skill can do in your session, and we did not judge why it does it.
Name clashes count folder names. The docs describe the replacement in local terminal sessions; we did not test every session type.

Reproduce it

The counts above, in all three weightings, are in project-skills-2026-11.json. Repo and skill names are left out. To check a repo yourself, run the four checks above before you start Claude Code in it.

For skills you choose to install yourself, the AgentCraft skills directory lists 5,101 Claude Code skills, and every community skill is reviewed before it’s listed.