Doesn't require a permissions bypass or a prompt, that's the point. Every agent here ships a workspace trust prompt but the payload fires before it's shown. `--dangerously-skip-permissions` is therefore irrelevant as the permission system never got consulted.

Delivery isn't self-inflicted either. A colleague sends you a zip or a client hands over a codebase. Inspecting `.git/config` before opening a shared project isn't standard practice. Pointing an agent at a project you were sent is what agents are for and exactly why these tools ship a workspace trust prompt. The issue here is that it fires too late.