As Claude Code and similar agentic coding tools sweep through developer workflows, an entire new configuration surface has quietly materialized inside our repos and home directories: the .claude/ folder. Olaf Alders' post is one of the first sustained attempts to catalog what actually lives there — and why security teams should be paying attention right now, not after the first supply-chain incident.

The .claude/ directory typically contains:

• settings.json / settings.local.json — permission allowlists, environment variables, and hook definitions that execute arbitrary shell commands on tool events
• hooks — shell scripts that fire on PreToolUse, PostToolUse, Stop, and other lifecycle events, running with the user's full privileges
• subagents and skills — reusable prompt bundles that can be invoked automatically
• MCP server configs — endpoints the agent will happily talk to, sometimes with secrets baked in
• CLAUDE.md files — prompt-injection payload delivery vectors dressed up as documentation

The attack surface is genuinely novel. A malicious CLAUDE.md checked into a dependency can quietly instruct a coding agent to exfiltrate ~/.ssh/ the next time a developer runs Claude Code in that repo. A hook script pulled from a "helpful" starter template can persist arbitrary code execution. Permission allowlists that look benign (Bash(git *)) turn out to permit git config --global core.hooksPath — a classic escape.

What makes the post valuable to a technical audience:

• It treats agent configuration with the same rigor security engineers apply to .git/hooks, .vscode/tasks.json, or .envrc — file categories that have all been abused in the wild
• It maps the trust boundaries: user settings vs project settings vs upstream-checked-in settings, and which of those a git clone can influence
• It hints at the review discipline teams need before the industry inevitably gets its "npm install" moment for coding agents

This is the kind of unglamorous plumbing writeup that ages very well. Six months from now, when the first well-publicized .claude/-based compromise hits the news, everyone will link back to posts like this and wonder why nobody was reading them at the time.