Profero Exposes Claude Skill-File Persistence Attack

Profero's EDR detection flagged Claude Desktop's --allow-dangerously-skip-permissions flag and found a cross-session persistence attack that existing threat models aren't built to catch. The flag strips all permission prompts from child processes except two hardcoded guards against recursive deletion. With Write or Edit tool access in a constrained session, an attacker can inject payloads into skill files at ~/.claude/skills/, plain markdown files with no checksums or integrity verification. Those files load as trusted context in later sessions that may carry full permissions. Essentially: (Profero, Claude Desktop) a sandboxed session becomes a staging ground for payload execution in a subsequent privileged one. - Skill files carry no signatures or checksums; injected writes are indistinguishable from legitimate agent behavior. - Read risks include ~/.ssh/id_rsa, .env files, and ~/.aws/credentials. - Deferred write vectors include shell configs, git hooks, and SSH keys executed outside the original session. The attack isn't a single flaw; it's prompt injection combined with write access to trusted context that persists across session boundaries.