Risks of the Claude Desktop Permission-Skip Flag

A new attack chain has been discovered that occurs when using the --allow-dangerously-skip-permissions flag in Claude Desktop. The key point is that simply blocking Bash execution alone cannot guarantee security.

Main Attack Vectors:

• Sensitive Data Theft: SSH private keys, .env files, AWS credentials, and browser session databases can be read.
• Deferred Execution: Malicious code can be written to ~/.zshrc, .git/hooks/pre-commit, ~/.ssh/authorized_keys, or source files within a repository, so that the payload executes later when the user opens a terminal or makes a commit.
• Persistence: A skill can be injected into the ~/.claude/skills/ directory, so that when the user invokes that skill in a new session days later, it runs with permissions.

Recommended Defensive Measures:

• Monitor the ~/.claude/skills/ directory for unexpected modifications.
• Thoroughly review all MCP (Model Context Protocol) tools and skills before installation.
• Audit shell configurations and Git hooks after agent sessions.
• Do not consider the --allow-dangerously-skip-permissions flag safe even when Bash is blocked.