How do I check whether an AGENTS.md or CLAUDE.md file in a downloaded folder or a parent directory is safe?

What should I check, step by step?

1. Don't start agents in Downloads, your home directory or a shared parent folder. Move or clone the project into a dedicated work folder whose parents you control. Claude Code concatenates every CLAUDE.md from the filesystem root down to your working directory, so one planted file in a parent applies to every project beneath it.

2. List instruction and config files in the folder and every parent before you start (macOS/Linux shell): d="$PWD"; while :; do ls -a "$d" | grep -E '^(CLAUDE(\.local)?\.md|AGENTS(\.override)?\.md|\.claude|\.codex|\.cursor|\.cursorrules)$' | sed "s|^|$d/|"; [ "$d" = / ] && break; d=$(dirname "$d"); done
3. Search inside the project too, because Claude Code loads subdirectory CLAUDE.md files when it reads or edits files there and Cursor applies nested AGENTS.md files for work in that directory: find . \( -name CLAUDE.md -o -name CLAUDE.local.md -o -name AGENTS.md -o -name AGENTS.override.md -o -name '*.mdc' -o -name .cursorrules -o -name .mcp.json \) -not -path '*/node_modules/*'. Then list .claude/, .codex/ and .cursor/rules/ directly.
4. Read each file raw (cat -A, or a plain editor), not as a rendered Markdown preview. Look for instructions to run commands, fetch URLs, read keys, tokens or SSH files, turn off checks, or hide what the agent did, and for invisible or bidirectional characters. Claude Code strips block-level HTML comments before loading a CLAUDE.md at launch, but they remain visible when Claude opens the file with its Read tool, so don't treat comments as harmless.
5. Follow imports: Claude Code expands @path imports (paths relative to the importing file, up to four hops) and shows an approval dialog the first time a project imports files outside your working directory. Decline unless you know those files. An @file mention in a Cursor rule tells Agent to read that file with its tools when it needs it.
6. Check the files that can run things, not just the instructions: .claude/settings.json (hooks, env, apiKeyHelper), .mcp.json, .codex/config.toml and .codex/hooks.json. Claude Code's docs say repository hooks in settings files are used even if you trusted only a parent folder, and in claude -p or SDK runs; Codex loads project-local hooks only when the project .codex/ layer is trusted.
7. Confirm what actually loaded. Claude Code: run /context and check Memory files, or /memory (subdirectory files load later and print a Loaded line). Codex: run codex --ask-for-approval never "List the instruction sources you loaded." or log with -c log_dir=./.codex-log. Cursor: open Customize and look at Rules.
8. Narrow discovery: Claude Code's claudeMdExcludes setting skips files by absolute path or glob (except a managed CLAUDE.md). In Codex, project_root_markers = [] treats the current directory as the project root so parents aren't searched. If your home directory is itself a git repository (some dotfile setups), Codex's default treats it as the project root and reads instruction files in every directory from home down to your working folder.
9. Enforce limits outside the instructions: Claude Code's docs say CLAUDE.md is context, not enforced configuration, and point to permissions.deny, hooks and the sandbox for rules that must hold. For claude -p in a repository you didn't write (no trust dialog appears), the docs suggest --setting-sources user or --bare, and --settings '{"disableAllHooks": true}'.

How each coding agent finds instruction files

Claude Code: managed policy, then ~/.claude/CLAUDE.md, then CLAUDE.md and CLAUDE.local.md from every directory between the filesystem root and the working directory, concatenated root first, so the file closest to you is read last. Files in subdirectories load on demand when Claude reads, writes or edits a file there. By default AGENTS.md is read only if there is no CLAUDE.md, .claude/CLAUDE.md or CLAUDE.local.md in the working directory or above it; AGENTS.local.md, AGENTS.override.md and .agents/ are not read.

• Codex: in the Codex home (~/.codex unless CODEX_HOME is set) it reads AGENTS.override.md, else AGENTS.md. Then from the project root down to the current directory it takes at most one file per directory (AGENTS.override.md, then AGENTS.md, then names in project_doc_fallback_filenames), joins them root first, and stops at project_doc_max_bytes (32 KiB by default). If it finds no project root, it checks only the current directory. An AGENTS.override.md replaces the AGENTS.md beside it, so search for both.
• Cursor: project rules are .mdc files in .cursor/rules (a plain .md there is ignored); alwaysApply rules go into every chat, others attach by glob, description or @-mention. AGENTS.md is supported in the project root and subdirectories, with nested files combined with their parents for work in that directory. Team Rules and User Rules come from the dashboard and your settings, not the folder.

Why downloaded folders and parent directories are the risk

Unzipping or cloning into a folder that already holds an old CLAUDE.md or AGENTS.md puts that file on the agent's path. You read the project's instructions, but Claude Code also loads the parent's, and the model gets both as instructions.

• Workspace trust doesn't cover this by itself. Claude Code shows its trust dialog in interactive sessions when you start in a folder you haven't trusted, and its docs list what a repository can still run when you trusted only a parent folder or ran claude -p, where no dialog appears. Reading the instruction files yourself and starting from a clean folder closes the gap trust prompts leave.
• Instruction files steer what the agent tries; permissions decide what it can do. Keep both in view: a hostile file can only ask, but an agent with broad allow rules, no sandbox and live credentials may do what it asks.