# How do I check whether an AGENTS.md or CLAUDE.md file in a downloaded folder or a parent directory is safe?

**Short answer:** Treat instruction files as text that steers your agent, and check every one it will load, not just the one in the project. The tools look in different places. Claude Code loads CLAUDE.md and CLAUDE.local.md from the directory you start it in and every directory above it, and loads ones in subdirectories once it works there; when no CLAUDE.md is on that path it reads AGENTS.md and .claude/AGENTS.md the same way (v2.1.277 or later). Codex reads your global ~/.codex file, then walks from the project root (by default the nearest directory at or above you that contains .git) down to where you started, taking one of AGENTS.override.md, AGENTS.md or a configured fallback name per directory. Cursor applies AGENTS.md in the project root and its subdirectories, plus .mdc rules in .cursor/rules. So a CLAUDE.md left in ~/Downloads is loaded by Claude Code for every project you start anywhere under ~/Downloads. Work from a dedicated folder you control, list instruction files in it, below it and in every parent, read them raw (including files they import with @path), then confirm what loaded: /context or /memory in Claude Code, or ask Codex to list its instruction sources. Instructions are context, not enforcement, and a repository's settings, hooks and .mcp.json can do more than its instructions can, so check those too.

## Checklist
1. Don't start agents in Downloads, your home directory or a shared parent folder. Move or clone the project into a dedicated work folder whose parents you control. Claude Code concatenates every CLAUDE.md from the filesystem root down to your working directory, so one planted file in a parent applies to every project beneath it.
2. List instruction and config files in the folder and every parent before you start (macOS/Linux shell): d="$PWD"; while :; do ls -a "$d" | grep -E '^(CLAUDE(\.local)?\.md|AGENTS(\.override)?\.md|\.claude|\.codex|\.cursor|\.cursorrules)$' | sed "s|^|$d/|"; [ "$d" = / ] && break; d=$(dirname "$d"); done
3. Search inside the project too, because Claude Code loads subdirectory CLAUDE.md files when it reads or edits files there and Cursor applies nested AGENTS.md files for work in that directory: find . \( -name CLAUDE.md -o -name CLAUDE.local.md -o -name AGENTS.md -o -name AGENTS.override.md -o -name '*.mdc' -o -name .cursorrules -o -name .mcp.json \) -not -path '*/node_modules/*'. Then list .claude/, .codex/ and .cursor/rules/ directly.
4. Read each file raw (cat -A, or a plain editor), not as a rendered Markdown preview. Look for instructions to run commands, fetch URLs, read keys, tokens or SSH files, turn off checks, or hide what the agent did, and for invisible or bidirectional characters. Claude Code strips block-level HTML comments before loading a CLAUDE.md at launch, but they remain visible when Claude opens the file with its Read tool, so don't treat comments as harmless.
5. Follow imports: Claude Code expands @path imports (paths relative to the importing file, up to four hops) and shows an approval dialog the first time a project imports files outside your working directory. Decline unless you know those files. An @file mention in a Cursor rule tells Agent to read that file with its tools when it needs it.
6. Check the files that can run things, not just the instructions: .claude/settings.json (hooks, env, apiKeyHelper), .mcp.json, .codex/config.toml and .codex/hooks.json. Claude Code's docs say repository hooks in settings files are used even if you trusted only a parent folder, and in claude -p or SDK runs; Codex loads project-local hooks only when the project .codex/ layer is trusted.
7. Confirm what actually loaded. Claude Code: run /context and check Memory files, or /memory (subdirectory files load later and print a Loaded line). Codex: run codex --ask-for-approval never "List the instruction sources you loaded." or log with -c log_dir=./.codex-log. Cursor: open Customize and look at Rules.
8. Narrow discovery: Claude Code's claudeMdExcludes setting skips files by absolute path or glob (except a managed CLAUDE.md). In Codex, project_root_markers = [] treats the current directory as the project root so parents aren't searched. If your home directory is itself a git repository (some dotfile setups), Codex's default treats it as the project root and reads instruction files in every directory from home down to your working folder.
9. Enforce limits outside the instructions: Claude Code's docs say CLAUDE.md is context, not enforced configuration, and point to permissions.deny, hooks and the sandbox for rules that must hold. For claude -p in a repository you didn't write (no trust dialog appears), the docs suggest --setting-sources user or --bare, and --settings '{"disableAllHooks": true}'.

## How each coding agent finds instruction files
- Claude Code: managed policy, then ~/.claude/CLAUDE.md, then CLAUDE.md and CLAUDE.local.md from every directory between the filesystem root and the working directory, concatenated root first, so the file closest to you is read last. Files in subdirectories load on demand when Claude reads, writes or edits a file there. By default AGENTS.md is read only if there is no CLAUDE.md, .claude/CLAUDE.md or CLAUDE.local.md in the working directory or above it; AGENTS.local.md, AGENTS.override.md and .agents/ are not read.
- Codex: in the Codex home (~/.codex unless CODEX_HOME is set) it reads AGENTS.override.md, else AGENTS.md. Then from the project root down to the current directory it takes at most one file per directory (AGENTS.override.md, then AGENTS.md, then names in project_doc_fallback_filenames), joins them root first, and stops at project_doc_max_bytes (32 KiB by default). If it finds no project root, it checks only the current directory. An AGENTS.override.md replaces the AGENTS.md beside it, so search for both.
- Cursor: project rules are .mdc files in .cursor/rules (a plain .md there is ignored); alwaysApply rules go into every chat, others attach by glob, description or @-mention. AGENTS.md is supported in the project root and subdirectories, with nested files combined with their parents for work in that directory. Team Rules and User Rules come from the dashboard and your settings, not the folder.

## Why downloaded folders and parent directories are the risk
- Unzipping or cloning into a folder that already holds an old CLAUDE.md or AGENTS.md puts that file on the agent's path. You read the project's instructions, but Claude Code also loads the parent's, and the model gets both as instructions.
- Workspace trust doesn't cover this by itself. Claude Code shows its trust dialog in interactive sessions when you start in a folder you haven't trusted, and its docs list what a repository can still run when you trusted only a parent folder or ran claude -p, where no dialog appears. Reading the instruction files yourself and starting from a clean folder closes the gap trust prompts leave.
- Instruction files steer what the agent tries; permissions decide what it can do. Keep both in view: a hostile file can only ask, but an agent with broad allow rules, no sandbox and live credentials may do what it asks.

## Ask Rightshold (free, no key)
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code (one-click setup: https://www.rightshold.com/start?ref=seo), then ask: "Before I start my coding agent in this folder, scan this AGENTS.md / CLAUDE.md for hidden text and for instructions aimed at the agent."

```json
{
  "tool": "scan_text",
  "arguments": {
    "text": "<the full raw contents of the AGENTS.md, CLAUDE.md or .mdc rule>"
  }
}
```
- Free, no key. It reports exact positions of zero-width and bidirectional characters, hidden markup and base64 blobs, and labels instruction-like language as a heuristic, never a certainty.
- precall_check with an MCP server's https URL from the folder's .mcp.json shows whether it is a listed server, what tools it exposes and whether its tool definitions changed, before you approve it.

_Rightshold does not run your coding agent, read your folders or decide which instruction files load. It scans text you send it and checks MCP servers you ask about. Not legal advice._

## Sources
- [Claude Code docs: How Claude remembers your project (CLAUDE.md load order, AGENTS.md, imports, claudeMdExcludes)](https://code.claude.com/docs/en/memory)
- [Claude Code docs: Configure permissions (what runs before you trust a folder, claude -p in a repository you didn't write)](https://code.claude.com/docs/en/permissions)
- [Claude Code docs: Security (prompt injection, trust verification)](https://code.claude.com/docs/en/security)
- [OpenAI Codex docs: Custom instructions with AGENTS.md (discovery order, overrides, size limit, verification)](https://developers.openai.com/codex/guides/agents-md)
- [OpenAI Codex docs: Advanced configuration (project root detection, project_root_markers, project hooks and trust)](https://developers.openai.com/codex/config-advanced)
- [Cursor docs: Rules (project rules, AGENTS.md, nested AGENTS.md)](https://cursor.com/docs/context/rules)

## Related
- [How to tell if a Claude Code or Cursor plugin is safe to install](https://www.rightshold.com/answers/how-to-tell-if-a-claude-code-or-cursor-plugin-is-safe-to-install)
- [How to vet a VS Code extension before installing it](https://www.rightshold.com/answers/how-to-vet-a-vs-code-extension-before-installing-it)
- [How to keep .env secrets and API keys away from AI coding agents](https://www.rightshold.com/answers/how-to-keep-env-secrets-and-api-keys-away-from-ai-coding-agents)
- [How to restrict network egress for AI coding agents](https://www.rightshold.com/answers/how-to-restrict-network-egress-for-ai-coding-agents)

_Not legal advice. Updated 2026-10-30. JSON: https://www.rightshold.com/answers/how-to-check-if-an-agents-md-or-claude-md-file-is-safe.json_