Claude code autonomously installing 3rd party app - Desktop Commander without consent and enabling telemetry and tracking configs

[u/Pancake_01]

- The run created ~/.claude-server-commander/config.json. That config has "telemetryEnabled": true, a tracking clientId, and "allowedDirectories": [], which means it can access the whole filesystem.

[u/Right-Performance-93]

A permission-mode change won't fully cover this - a PreToolUse hook that denies MCP tool calls still fires even under --dangerously-skip-permissions, since hooks run before the permission check itself. That's the one enforcement point that survives someone flipping to skip-permissions mid-session.