# --dangerously-skip-permissions: how to use it safely

> Is Claude Code's dangerously-skip-permissions flag safe? Only in a container or VM with no host secrets, scoped keys and a network allow-list.

Source: https://shuriken.sh/guides/skip-permissions-safely

Is Claude Code's dangerously-skip-permissions flag safe? Only in a container or VM with no host secrets, scoped keys and a network allow-list.

By Shuriken Updated 27 October 2026 5 min read

**Contents**

Claude Code's --dangerously-skip-permissions is safe only where a mistake can't hurt you: a container or VM with none of your machine's secrets in it, short-lived, narrowly scoped keys, outbound traffic cut to an allow-list, and a repository you trust. On your everyday laptop, signed in to everything, it isn't. Anthropic's own docs say to use it only in isolated environments.

We have a stake in this. A new Claude Code chat in Shuriken starts in the same mode, so where the line sits is a question we had to answer for our own app.

## What the flag does #

The flag starts Claude Code in bypassPermissions mode (the community calls it YOLO mode). Per Anthropic's [permission modes page](https://code.claude.com/docs/en/permission-modes), it "disables permission prompts and safety checks so tool calls execute immediately, including writes to protected paths" such as .git, .claude and your shell's .zshrc.

Two sentences on that page set the limits: "Only use this mode in isolated environments like containers, VMs, or dev containers without internet access, where Claude Code cannot damage your host system." and "bypassPermissions offers no protection against prompt injection or unintended actions."

Four things still hold in this mode:

- Deny rules. "Deny rules block in every mode, including bypassPermissions."
- Explicit ask rules still prompt, and so do recognised rm and rmdir removals of critical paths.
- A PreToolUse hook that denies a call, such as one that exits with code 2, still blocks it.
- Root is refused. On macOS and Linux, Claude Code won't start in this mode as root or under sudo, outside a recognised sandbox.

You accept responsibility once, on the first interactive start, and Claude Code stores that answer in ~/.claude/settings.json.

## When skipping prompts is reasonable #

| Situation | Reasonable? | Why |
| --- | --- | --- |
| A dev container with a network allow-list, no host secrets mounted, your own repo | Yes | Damage stays inside the container; the network limits where data can go |
| A throwaway VM or cloud box for one task, repo-scoped token | Yes | Nothing on it you'd miss; the token reaches one repo |
| Your laptop, but in a fresh worktree "so it's contained" | No | The agent still runs as you, with your SSH keys, cloud credentials and browser data in reach |
| Any repo you didn't write, or that pulls issues, web pages or docs from strangers | No | Prompt injection: text in a file can steer the agent, and nothing stops it acting |
| CI with production deploy keys in the environment | No | One bad command has production reach |

## How to set it up safely #

- Run it in a container or VM. Anthropic publishes a Dev Container Feature for Claude Code and a [reference dev container](https://github.com/anthropics/claude-code/tree/main/.devcontainer) whose firewall script, init-firewall.sh, limits outbound traffic to the destinations it allows. Its [dev container docs](https://code.claude.com/docs/en/devcontainer) note that because the container runs Claude Code as a non-root user, "you can pass --dangerously-skip-permissions for unattended operation".
- Mount nothing secret: no ~/.ssh, no ~/.aws or other cloud credential files. For GitHub, a fine-grained token on the one repository; the docs say to "prefer repository-scoped or short-lived tokens".
- Limit the network. The reference init-firewall.sh sets iptables' outbound policy to DROP. Besides DNS, SSH on port 22, localhost and the host's own /24 network, it lets through only GitHub's ranges from api.github.com/meta, registry.npmjs.org, api.anthropic.com, sentry.io, statsig.com and the VS Code marketplace and update hosts. Everything else is rejected, and the script checks that https://example.com can't be reached. Add the hosts your build needs, such as pypi.org. A session that can't reach arbitrary hosts can't send your code to them.
- Keep deny rules and hooks anyway, since they still apply in this mode. Deny reads of .env and anything secret, and block the commands you never want. Starting points are in [allow, ask and deny rules](https://shuriken.sh/guides/claude-code-permission-rules) and [hooks you can copy](https://shuriken.sh/guides/claude-code-hooks-examples).
- Use only repositories you trust. Before anything leaves the container, read git diff --stat and then the diff.
- Where you never want the mode, set permissions.disableBypassPermissionsMode to "disable". In your own user settings that locks you out; in managed settings it locks out a whole team.

One sentence in Anthropic's docs limits what the container buys: "When executed with --dangerously-skip-permissions, dev containers do not prevent a malicious project from exfiltrating anything accessible inside the container, including the Claude Code credentials stored in ~/.claude." The container protects your machine, not what you put inside it.

Shuriken runs your agents on your own computers; its cloud only relays end-to-end encrypted messages.

[Download](https://shuriken.sh/download)

## Safer ways to get fewer prompts #

If the reason for the flag is approving the same npm run test over and over, four settings ask less without dropping every check:

- Allow rules for the commands you run all day, such as Bash(npm run test *) and Bash(git commit *), so only the unusual ones ask.
- acceptEdits mode (Shift+Tab), which approves file edits and common filesystem commands in the project.
- The built-in sandbox (/sandbox, on macOS, Linux and WSL2) in auto-allow mode. Sandboxed shell commands run without asking because the operating system enforces the file and network limits. It covers shell commands only; file tools, MCP servers and hooks run outside it.
- Auto mode, where a separate classifier reviews actions before they run. Anthropic warns it "reduces permission prompts but does not guarantee safety".

A run while you sleep needs more than permissions: a computer that stays awake, a session that outlives the terminal, and a plan for usage limits. Those three are in [running Claude Code overnight](https://shuriken.sh/guides/run-claude-code-overnight).

## What Shuriken does, and what it doesn't #

A new chat in Shuriken starts in Full access, which for Claude Code is bypassPermissions. The mode picker describes it as "The agent edits files and runs commands without asking". A mode you saved for the project or the agent wins over that default, and the picker also offers Plan, Always ask, Accept edits and Auto-approve. Full access is the default because it's the mode we run in ourselves, which means everything above applies to a Shuriken chat from its first message.

Every chat except the Main chat gets its own branch in its own [git worktree](https://shuriken.sh/blog/worktree-per-chat), so its edits land in its own folder, not in another chat's or on your branch.

It is not a sandbox, and we say so because it's easy to assume otherwise. An agent in Shuriken runs on your computer as you, with your access, like a CLI in your terminal; chats are not isolated from the rest of your machine. Our [security page](https://shuriken.sh/security) spells out what that means, including that an agent can read what Shuriken itself keeps on that computer. So keep Full access for a machine or container where full access is acceptable, and switch the chat to Always ask anywhere else. A server you add to Shuriken can be that machine, and chats run there the same way. To run your agents on boxes you control, [download Shuriken](https://shuriken.sh/download).

Share

[X](https://x.com/intent/post?url=https%3A%2F%2Fshuriken.sh%2Fguides%2Fskip-permissions-safely&text=--dangerously-skip-permissions%3A%20how%20to%20use%20it%20safely)[LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fshuriken.sh%2Fguides%2Fskip-permissions-safely)[Hacker News](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fshuriken.sh%2Fguides%2Fskip-permissions-safely&t=--dangerously-skip-permissions%3A%20how%20to%20use%20it%20safely)[Reddit](https://www.reddit.com/submit?url=https%3A%2F%2Fshuriken.sh%2Fguides%2Fskip-permissions-safely&title=--dangerously-skip-permissions%3A%20how%20to%20use%20it%20safely)[E-mail](mailto:?subject=--dangerously-skip-permissions%3A%20how%20to%20use%20it%20safely&body=https%3A%2F%2Fshuriken.sh%2Fguides%2Fskip-permissions-safely)

## Sources

- [Permission modes (Claude Code docs)](https://code.claude.com/docs/en/permission-modes) (accessed 22 October 2026)
- [Development containers (Claude Code docs)](https://code.claude.com/docs/en/devcontainer) (accessed 22 October 2026)
- [Configure the sandboxed Bash tool (Claude Code docs)](https://code.claude.com/docs/en/sandboxing) (accessed 22 October 2026)
- [Reference dev container (anthropics/claude-code on GitHub)](https://github.com/anthropics/claude-code/tree/main/.devcontainer) (accessed 22 October 2026)
- [init-firewall.sh (anthropics/claude-code on GitHub)](https://github.com/anthropics/claude-code/blob/main/.devcontainer/init-firewall.sh) (accessed 25 October 2026)

## Frequently asked questions

**Is --dangerously-skip-permissions safe?**

Only inside an isolated environment: a container or VM with no host secrets mounted, short-lived scoped keys and outbound traffic limited, as Anthropic's init-firewall.sh does. On your own laptop, with ~/.ssh and your cloud credentials in reach, it isn't.

**What is YOLO mode in Claude Code?**

The community's name for running with --dangerously-skip-permissions, which is the bypassPermissions mode: Claude runs every tool without asking.

**Do deny rules still work with --dangerously-skip-permissions?**

Yes. Anthropic's permission modes page says deny rules block in every mode, bypassPermissions included. Explicit ask rules still prompt, and a PreToolUse hook that denies a call still blocks it.

**Is there a safer way to get fewer prompts?**

Yes. Allow rules such as Bash(npm run test *) for the commands you trust, acceptEdits mode (Shift+Tab), the built-in sandbox with auto-allow, or auto mode, where a classifier reviews actions before they run.

Your machines

Your agents run on your computers.

The cloud only links your devices and relays end-to-end encrypted messages. It runs no agents and stores no code.

[Download](https://shuriken.sh/download)

[Other platforms](https://shuriken.sh/download#main)

## Keep reading

- [Shared projects beta: share a project with a friend: Update 27 Oct 2026 3 min read Shared projects (beta) let a friend work in one of your projects on your computer, with your files and your Claude. Both sides opt in; sharing needs Pro.](https://shuriken.sh/blog/shared-projects-beta)
- [Shared projects: who gets what access: Update 27 Oct 2026 4 min read Shared projects are an opt-in beta in Shuriken 5.1. The trust model: what a member can reach, the controls you keep, and who to invite.](https://shuriken.sh/blog/shared-projects-trust)
- [Can you have multiple Claude accounts?: Guide 27 Oct 2026 8 min read Yes. Anthropic's terms set no cap on accounts per person, and its phone check allows three per number. Sharing a login and dodging a ban are not allowed.](https://shuriken.sh/guides/multiple-claude-accounts-rules)

## Free tools

- [Claude limit reset tracker](https://shuriken.sh/tools/limit-resets/claude)
- [Codex limit reset tracker](https://shuriken.sh/tools/limit-resets/codex)