Are Claude Skills Safe? A 10-Minute Audit Before You Install One

In February 2026, Snyk's researchers analysed 3,984 skills from two public skill directories. They confirmed 76 malicious payloads, and found that 13.4% of all the skills they looked at had at least one critical security issue. Of the malicious ones, 91% combined ordinary malware with prompt injection: instructions written to talk the agent into running code a person would refuse.¹

So, are Claude skills safe? The format is as safe as the files in it. A skill is instructions plus, often, scripts that run with your agent's permissions: your files, your shell, your keys. Anthropic's own documentation says to use skills only from trusted sources and to audit anything else before use.² Here's what to look for, and a ten-minute audit you can run on any skill.

Why are skills a security risk at all?

Because they're designed to be trusted. When a skill activates, the agent reads its instructions and follows them, and can run its scripts. Anthropic's documentation puts the risk plainly: "a malicious Skill can direct Claude to invoke tools or execute code in ways that don't match the Skill's stated purpose", and depending on Claude's access, that can lead to "data exfiltration, unauthorized system access, or other security risks".²

OWASP now tracks this as its own category. The OWASP Agentic Skills Top 10 rates "AST01 — Malicious Skills" critical and notes that because skills run with the host agent's full permissions, a malicious one can reach "API keys, SSH credentials, wallet files, browser data, and the shell".³

The patterns researchers found are worth knowing by name:^{1 3}

The 10-minute skill audit

Run these before you install anything from outside your own team or a vendor you trust.

1. Check the source (1 minute). Who published it? Is there a repository with a readable history, an issue tracker, a real person or company? A skill that appeared last week from a brand-new account deserves extra care.

2. Read the whole SKILL.md (3 minutes). Not just the description. Look for anything that doesn't match what the skill says it does: instructions to fetch URLs, to disable checks, to keep something from the user, to touch files outside the task, or a "Prerequisites" section that asks you to run commands.

3. Scan the scripts for red flags (3 minutes). These commands surface most of them:

cd some-skill/
# network access and downloads
grep -rnE "curl|wget|requests\.|urllib|fetch\(|http[s]?://" .
# code that runs other code, or hides it
grep -rnE "eval\(|exec\(|base64|subprocess|os\.system|child_process" .
# reaching for secrets
grep -rnE "\.ssh|\.env|id_rsa|keychain|API_KEY|TOKEN|aws_" .
# installs from somewhere
grep -rnE "pip install|npm install|curl .*\| *(ba)?sh" .

A match isn't proof of malice; many good skills call requests. It tells you where to read carefully.

4. Check what it fetches at runtime (1 minute). Anthropic flags skills that pull content from external URLs as particularly risky, because "fetched content may contain malicious instructions", and because even a trustworthy skill "can be compromised if their external dependencies change over time".² Prefer skills that are self-contained.

5. Check the permissions it asks for (1 minute). An allowed-tools line in the front matter pre-approves tools while the skill runs. Bash(git:*) is narrow; Bash(*) pre-approves every shell command. A plugin can also install hooks and MCP servers, so read what it adds before you install it; Claude Code's plugin panel shows the list for that reason.⁴

6. Decide (1 minute). If anything doesn't match the skill's stated purpose and you can't explain it, don't install it. A skill that saves you an hour isn't worth your SSH keys.

Can Claude audit a skill for you?

It can help, with one caution: the skill's text is exactly the kind of content that may contain instructions aimed at an AI. Ask Claude to review the files as data, in a session where the skill isn't installed and Claude has no tools that can run anything, and treat its summary as a second opinion next to your own read, not instead of it.

Reduce the blast radius anyway

Even careful reviewers miss things, so assume a skill could misbehave and limit what it can reach:

• Use the narrowest permission mode that works. In Claude Code, Manual mode asks before edits and commands; dontAsk with an allowlist denies anything not pre-approved.⁵ Reserve bypass mode for isolated containers and VMs.
• Sandbox experiments. Try new skills in a container, a VM or a throwaway user account without your real keys.
• Keep secrets out of reach. Don't run unknown skills in a shell that has production credentials in its environment.
• Pin and review updates. Third-party marketplaces have auto-update off by default in Claude Code;⁴ leave it that way for anything you haven't reviewed.
• For organizations: Claude Enterprise can scan custom skills uploaded in Claude.ai and Cowork; skills uploaded through the API or Console aren't covered by that scan.²

If you publish skills, make them easy to audit

Snyk's recommendations for skill authors match what buyers should look for:¹

• Build skills as self-contained packages, without auto-updating or remote code execution.
• Handle credentials through environment files or vaults, never in the skill.
• Keep scripts short, readable and commented, so a reviewer can follow them in minutes.
• State in SKILL.md exactly what the scripts do and what they touch.

FAQ

Are Anthropic's official skills safe?

Anthropic's documentation names "those you created yourself or obtained from Anthropic" as trusted sources.² Everything else deserves the audit, including skills from big directories.

Is a popular skill safer?

Not necessarily. Snyk's advice is direct: "Popularity is not a safe proxy for security."¹ Malicious skills were found in public directories alongside popular ones.

Are paid skills safer than free ones?

Not by default. Price says nothing about the code. Audit paid skills the same way, and prefer sellers who show you the files and explain what the scripts do.

What should I do if I installed a suspicious skill?

Disable and remove it, then rotate any credentials the agent could reach while it was active, check recent shell history and outgoing connections, and look for changes to memory or settings files that could persist.³