Claude Code Guessed Drupal From an Email Even in Safe Mode — So the Author Built a /ccu Skill

You ask an AI agent for neutral advice and get an answer tailored to you. Not because the model is flattering you, but because it reads everything you've left for it: instructions, skills, memory, even your email address. The author of this story learned firsthand that removing this noise is harder than it seems.

Drupal Instead of Neutral Advice

The author asked Claude Code which CMS it would recommend. The answer: Drupal. When asked "why," the agent honestly explained that it had seen a custom Drupal skill and concluded that the user works with it. Logical: personal CLAUDE.md files, skills and settings turn the agent into an echo of its owner.

The author then found the --safe-mode flag, which promises to launch without CLAUDE.md, skills, plugins, hooks and MCP servers under the same subscription. They asked again and got Drupal again. This time the chain of reasoning was: an email in the agent's context, the domain amazee.io, a company known for Drupal hosting, therefore the user works in a Drupal-oriented environment. The config was gone, but the identity remained.

How /ccu Works

The solution was the /ccu skill (Claude Code, Unbiased by me). The author doesn't need a full clean session, just a quick check now and then, which is why it's a skill. The main agent writes a prompt, copies the necessary files into an empty folder, launches a clean instance there and brings back the answer.

The isolation is simple. Each run gets a fresh temporary directory with two folders: work for the task files and an empty home. The launch then goes roughly like this: change into work, then env -i with HOME pointing to the empty folder, PATH and the OAuth token, and after that claude -p with the desired model and the prompt as input.

The env -i flag starts with an empty environment, so nothing leaks from the shell. The token is the same as in the current session, and the skill takes it from the macOS Keychain. The subscription stays the same, but the email disappears: the account profile lives in .

claude.json, which is written at login, and the clean home doesn't have it.

There is a nuance with permissions. The claude -p mode rejects any tool that requires confirmation, since there is nobody to confirm. So the main agent lists the necessary tools in advance in work/.claude/settings.json, for example WebFetch, WebSearch and Bash(curl:*). But in an untrusted folder these settings are ignored, so /ccu marks work as trusted via hasTrustDialogAccepted in .claude.json inside home.

One more detail: after the run, the skill turns the raw log into a readable transcript.md. The main agent receives only the clean instance's answer and does not read the transcript. A human can look at it to check whether the main agent influenced the result.

Why This Matters in Practice

The takeaway is broader than CMS choice. Any advice from an agent with accumulated context should be treated as personalized. If you're choosing a stack, evaluating an architecture or asking for a review of your text, the answer will be skewed toward what the agent knows about you. The author also uses /ccu for blog persona reviewers, such as an editor or a colleague, who shouldn't know who the author is.

The practical conclusions:

• Don't trust a "safe mode" flag as a guarantee of cleanliness: check what actually ends up in the context, including account data.
• For fair comparisons, run the model in a separate HOME with an empty environment, rather than just disabling plugins.
• If you automate runs via claude -p, plan permissions ahead and account for the folder trust rule.

There are limitations too. The solution depends on the macOS Keychain and on specific Claude Code behavior that may change. The token still belongs to your subscription, so handle it carefully. And even a clean instance sees the OS, the shell, the temp folder path and the date, which means an absolutely neutral answer doesn't exist.

And the CMS? In a clean instance, Claude Code recommended Payload. The difference between Drupal and Payload shows just how much of you there is in an agent's ordinary answers.