Claude Code's --dangerously-skip-permissions flag is powerful — it lets the AI execute any shell command without asking for confirmation. This enables fully autonomous coding sessions, but on your bare machine it's risky: a prompt injection (via a malicious file, PR description, or fetched URL) could silently read your SSH keys, AWS credentials, or inject code into your shell config.
Use a lightweight Linux VM as the sandbox. The VM provides kernel-level isolation while your project files are mounted in from the host via SSHFS. Claude can do whatever it wants inside the VM — your host machine stays protected.