The .claude directory creates an attack surface in Claude Code

When Claude Code runs in a newly cloned repository, it asks for trust but fails to warn about the presence of a .claude directory included in the project. The default response to this prompt is trust, making it easy to bypass security checks with a quick Enter key press.

Granting trust enables all hooks in the repository without individual permission requests. For example, a SessionStart hook can execute a curl command to download and run an external script. This trust is persistent: a malicious hook added in a future commit will execute without a new prompt.

Local skill files within the repository can also execute arbitrary code. To mitigate this, the author recommends declining the trust prompt, setting disableAllHooks to true in ~/.claude/settings.json, or running the tool within a sandbox environment like nono.