Check six agent config files before running coding agents in cloned repos

On 2026-11-02 00:01, DEV Community's AI section published a technical advisory titled 'Check 6 Agent Config Files Before Cloning a Repo'. The author argues that when you clone someone else's repository to reproduce a reported bug, running Claude Code, Codex, or Gemini CLI in that folder before you have read a single line of code means the repo's own config files may execute commands or inject instructions before you ever inspect the source. The trust mechanisms differ across tools: one of them ships with trust checks disabled by default, and Claude Code's trust confirmation dialog does not appear under claude -p. The author claims the six files can be checked one by one in roughly a minute using git grep and jq. As an illustration, the article notes that Claude Code's hooks reference lists .claude/settings.json as a hook location you can commit, meaning a repository can carry settings that apply to your local agent. The piece stops at the warning stage and does not enumerate the full list of six files.