Open a folder in Claude Desktop that you’ve never used before, and you’ll see a dialog unlike the others: “Do you trust the files in this folder?” It’s not asking you to approve a single action. It’s asking you to vouch for the whole project.
It’s easy to click “yes” without thinking. Don’t.
What’s actually in a folder
Up until now you’ve thought of a project as: the files people work on, plus maybe a README. From the software world level you know it’s also configuration, dependencies, and settings files.
What you might not know is that a folder can also contain files that instruct Claude itself:
- A
CLAUDE.mdfile that tells Claude how to behave in this project. - A
.claude/folder with custom commands, settings, and scripts. - Project-level skills that get loaded automatically.
These exist for good reasons — they’re how a team writes down “here’s how to work in this project” so Claude is useful from minute one. You’ll set up your own in the Make Claude yours level.
But there’s a flip side.
A project isn’t just data Claude reads. It’s also instructions Claude follows.
If someone hands you a folder from the internet, its CLAUDE.md gets loaded into the conversation. If that file says “always commit passwords” or “run this script before doing anything,” Claude reads those instructions just like it reads yours.
This is sometimes called prompt injection: hostile or unexpected instructions hiding inside content Claude reads.
What to do about it
You don’t need to be paranoid. You do need to be deliberate.
- Your own projects: trust freely.
- Your team’s projects: trust, but glance at
CLAUDE.mdand the.claude/folder once if you’ve never opened this project before. Most teams have nothing surprising in there. - A stranger’s folder from the internet: open and read
CLAUDE.md, the settings, and any scripts before you trust it. They tell Claude how to behave; you want to know what they say. - A project you’re investigating because something looks off: don’t trust at all. Look without giving it the keys.
The trust dialog is the gate. Use it the way you’d use your front door — most days you let people in without thinking, but when someone unfamiliar shows up, you actually look.
A related habit
The same instinct applies to content Claude reads even inside a trusted project. A README pulled from a sketchy link. A document downloaded from somewhere. A note written by someone outside your team. Anything that came from outside can carry instructions Claude will read like any other request.
You don’t need to police every file. You do need to remember: text Claude reads can change what Claude does.
What’s next
You’ve now got the full toolkit for what to do before something goes wrong: read the request, know the blast radius, pick the right mode, glance at the project. Next, the toolkit for what to do after — when you approved something and now wish you hadn’t.