Are Claude Skills Safe? How to Vet an Agent Skill Before You Install It
No, Claude skills are not safe by default. A skill can run code and steer Claude's tools with your permissions. Check the publisher and read every file before you install it.
A skill is a folder of instructions, and sometimes code, that Claude loads on demand. Read what an Agent Skill is for the format itself. Every Verify AI Skills verdict grades a skill from A to F. The grade comes from its files at a pinned commit. The checklist on this page repeats what our verdicts check, so you can run it on any skill.
Are Claude skills safe?
No, Claude skills are not safe by default. Anthropic advises installing them only from trusted sources and auditing every file. A skill can run code with your permissions, so a malicious one can steal data.
| Grade | Meaning (our methodology) | Skills we have reviewed | Example verdict and what we found |
|---|---|---|---|
| A | No executable code | 17 | Frontend Design (Recommended, 76): "Two text files, one 71-line SKILL.md and an Apache 2.0 licence, with no executable code, network calls or credentials" |
| B | Scripts present, nothing alarming | 12 | Designer Skills Collection (Recommended, 78): "seven Python and shell maintenance scripts for CI and packaging that users never run, with no telemetry, secrets or hidden endpoints" |
| C | Needs credentials or broad permissions | 10 | Skill Creator (Conditional, 57): "ten Python scripts that spawn autonomous claude -p sessions with the user's own permissions" |
| F | Secrets, undisclosed endpoints, telemetry or unsafe behaviour | 0 | — |
The grade comes from reading the files, not from a penetration test. None of our verdicts holds a D or E grade.
Anthropic's platform docs say: "Use Skills only from trusted sources: those you created yourself or obtained from Anthropic." They add: "Treat like installing software." A trusted skill still carries risk over time. Anthropic warns that "Even trustworthy Skills can be compromised if their external dependencies change over time." The Claude Help Center names two primary risks: prompt injection and data exfiltration.
The Claude product you use changes the risk. Anthropic's runtime notes give each surface a different network reach:
| Surface | Network access for skills (Anthropic platform docs) |
|---|---|
| Claude API | No network access |
| claude.ai | Varying network access, set by user and admin settings |
| Claude Code | Full network access |
Are Claude Code skills safe to use?
No, not by default. Claude Code gives skills the most reach of any Claude surface. Three facts from Anthropic's docs explain why:
- Full network access. A skill in Claude Code reaches the network like any other program on your machine.
- Load-time shell commands. Claude Code's docs say "The
!`<command>`syntax runs shell commands before the skill content is sent to Claude". Datadog Security Labs, a vendor research team, used this path in an attack demo (vendor-reported). - Pre-approved tools. An
allowed-toolsfield pre-approves the listed tools for the invoking turn. Workspace trust does not gate it, though deny and ask rules still override it.
Teams can switch load-time commands off with "disableSkillShellExecution": true. The docs say this works best in managed settings. Each command is replaced with "[shell command execution disabled by policy]". Bundled and managed skills are not affected.
What security risks hide inside agent skills?
Agent skills hide seven main security risks. Instructions can inject prompts, scripts and load-time shell commands can run code, and network calls can leak data. Skills can expose credentials, pre-approve tools, or fetch new instructions.
The table maps each risk to the OWASP Agentic Skills Top 10 (AST10). AST10 is OWASP's list of the ten most critical risks in agent skills. The "Anthropic level" column follows the risk indicators in Anthropic's enterprise skills guide.
| Risk | What it looks like | Anthropic level | AST ID | Example |
|---|---|---|---|---|
| Instruction manipulation | "directives to ignore safety rules, hide actions from users" | High | AST01 | Virtue AI found offensive personas and attack tutorials inside skills (vendor-reported) |
| Scripts | *.py, *.sh and *.js files that "run with full environment access" |
High | AST01 | Script-bundling skills were 2.12× more likely to be vulnerable (arXiv 2601.10338) |
| Load-time shell commands | !`command` lines that run before Claude reads the skill |
n/a | AST01 | Datadog's Clawsights demo read a GitHub token and uploaded it (vendor-reported) |
| Network calls | URLs, fetch, curl, requests |
High | AST05 | Data leaves the machine through any call the skill makes |
| Pre-approved tools and broad permissions | allowed-tools grants apply without a prompt during the invoking turn |
n/a | AST03 | Datadog flags unrestricted Bash(*) grants |
| Credentials | Hardcoded secrets and credential reads | High | AST03 | Snyk found secrets in 10.9% of ClawHub skills vs 2.0% of the skills.sh top 100 |
| External instructions | Instructions fetched at run time from outside sources | n/a | AST05, AST07 | Anthropic's dependency warning above |
Scripts carry a quieter supply-chain risk too. SafeDep's agent skills threat model shows PEP 723 script dependencies stay unpinned until uv resolves them at run time. The code you read is then not the code that runs.
A grade C needs no script at all. Our shadcn/ui skill review found a Markdown-only skill with grade C. Our review found that it "executes unpinned npx shadcn@latest at load time and pre-approves every shadcn@latest subcommand".
Grade A means no executable code in the package. It does not mean the instructions are harmless. Our Find Skills verdict gives it grade A. Yet it "instructs the agent to run the public npx skills CLI".
What did recent studies find about malicious agent skills?
Recent studies in 2026 found vulnerable agent skills are common. One analysis of 31,132 skills found 26.1% with at least one vulnerability. Snyk's scan of 3,984 skills found critical issues in 13.4% and 76 confirmed malicious payloads.
| Study | Date | Sample | Findings | Evidence label |
|---|---|---|---|---|
| "Agent Skills in the Wild" (Liu et al., arXiv 2601.10338) | 2026-01-15 | 42,447 collected, 31,132 analysed | 26.1% with at least one vulnerability; 14 patterns in 4 categories; exfiltration 13.3%; privilege escalation 11.8%; 5.2% high-severity; scripts 2.12×; precision 86.7%, recall 82.5% | research preprint |
| Snyk ToxicSkills | 2026-02-05 | 3,984 skills from ClawHub and skills.sh | 13.4% (534) critical; 36.82% (1,467) any flaw; 76 confirmed malicious payloads; 91% of confirmed malicious skills use prompt injection; mcp-scan engine | vendor-reported |
| Virtue AI | 2026-01-14 | 10,000+ Claude Skills from Smithery.ai | A small, unquantified subset embeds attack tutorials and offensive personas | vendor-reported, method not described |
| Datadog Security Labs (Frichette and Simon) | 2026-05-11 | Clawsights demo skill | Token read at line 41 and uploaded at line 90; Opus 4.6 at maximum reasoning refused; Opus 4.7 ran it without flagging, consistent across runs | vendor-reported, not independently reproduced |
| SkillJect (arXiv 2602.14211) | 2026-02-15 | Automated poisoned-skill generator | Hides the payload in a helper script and rewrites instructions to call it | research preprint |
| Skill-Inject (arXiv 2602.20156) | 2026-02-23 | 202 injection-task pairs | "up to 80% attack success rate with frontier models" | research preprint |
| ClawHavoc (OWASP timeline) | 2026-01-27 to 2026-01-29 | ClawHub registry | 341 malicious skills in 3 days; final tally 1,184 across 12 publisher accounts | OWASP-reported |
One model refused the attack and the next model ran it. Datadog writes that "no model will ever be 100% resistant to prompt injection". Model refusal is not a security control.
Two figures get misquoted often. Some secondary pages report "1,467 malicious payloads". Snyk's own study says 1,467 skills had any flaw, and 76 were confirmed malicious. One dev.to guide credits the 26.1% rate to SmartScope. The source is the arXiv paper 2601.10338.
These are registry findings. They describe open marketplaces such as ClawHub, OpenClaw's public skill registry, and skills.sh, not Anthropic's own skills.
How do you check if a Claude skill is safe before installing it?
You check a Claude skill before installing it with ten checks. Confirm the publisher, pin the version and read every file. Then trace scripts, shell commands, network calls, credentials, permissions and dependencies, isolate it, and scan it.
Each step names what to look for, its source and its AST10 row:
- Confirm the publisher. Anthropic's trusted sources are skills you wrote and skills from Anthropic. Watch for look-alike names, a typosquatting threat in SafeDep's model. (AST02)
- Pin the version. Record the full commit you reviewed, because a default branch moves. Re-check after every update. (AST07)
- Read SKILL.md and every referenced file, nested files included. Anthropic and Backslash both put this step first. (AST01)
- List every script, hook, binary and
!`command`line. Run scripts only in a sandbox, per Anthropic and Datadog. (AST01) - Search for adversarial instructions that do not match the stated purpose. The dev.to audit greps for
curl,wget,evalandbase64. (AST01) - Trace network calls such as
http,requests.get,urllib,curlandfetch. (AST05) - Check credentials and secrets, environment variable reads included. Datadog lists env var access as a detection signal. (AST03)
- Check permissions:
allowed-tools,Bash(*)and any file-read plus network combination. The dev.to guide says: "Skills requestingbashordockeraccess need a clear reason." (AST03) - Check dependencies and redirect domains, and prefer pinned versions over
@latest. Isolate the first install in a sandbox or a single project. (AST02, AST06) - Scan the skill, then corroborate with an independent verdict. Our ranking of the highest-rated skills, safety-graded starts from this work. (AST08)
Teams need one more control: an inventory of installed skills. The Cloud Security Alliance warns: "Without a skill inventory, every other security control is blind." Our verdicts already run checks 1 to 8 by reading the files at a pinned commit.
How do signing and integrity checks protect a skill?
Signing proves a skill came from its publisher unaltered. The Agent Skills specification has no signature, hash or attestation field. Integrity today rests on three practices:
- Pin the source. Claude Code marketplaces pin a full 40-character
sha, and ziparchivesources take asha256that Claude Code enforces. Our setup guide shows how to pin a plugin marketplace to a commit. - Follow OWASP's mitigations. AST01 lists Merkle root signing, and AST07 lists immutable pinning with hash verification.
- Sign releases. Red Hat lists skill signing among its recommended controls.
How does our A to F safety grade rate a skill?
Our A to F safety grade rates a skill by reading every file at a pinned commit. A means no executable code; B means harmless scripts. C needs credentials or broad permissions; F means secrets, hidden endpoints or telemetry.
The grade comes from reading the files. It is not a penetration test, a security audit or a certification.
The grade and the verdict measure different things. Landing Page Design holds grade A and scores 50 with Low confidence. That makes it a grade-A skill we don't recommend, labelled Not Recommended. Using Neon holds grade C and scores 76 with Moderate confidence. It is a grade-C skill we recommend, labelled Recommended. The catalogue lists every skill we have reviewed, with its safety grade. Read the full review methodology for scoring, refresh triggers and corrections.
Which tools scan agent skills for security issues?
Tools that scan agent skills for security issues include Anthropic's skill scanning for Claude Enterprise and Snyk's mcp-scan engine. Each catches different threats. A passing scan is not a guarantee of safety.
| Tool | Where it runs | What it checks | Status |
|---|---|---|---|
| Anthropic skill and plugin scanning | Enterprise plans in Claude, Cowork and Enterprise plugin marketplaces | Pass, warn or fail in 1 to 2 minutes; on by default from 2026-10-02 for orgs that had not set it | Official source |
| Snyk mcp-scan engine | Your machine: uvx mcp-scan@latest --skills (per dev.to) |
Installed skills; dev.to says it misses obfuscated patterns | Not reviewed by us |
| safedep/vet and cisco-ai-defense/skill-scanner | Named by SafeDep | Dependency and skill scanning | Not reviewed by us |
| Cloud Security Partners review skill | An open-source skill using OSS Scorecard heuristics | Skill repository health | Not reviewed by us |
| skills.sh registry audits | skills.sh skill pages | Third-party audit results per skill | Shown on registry pages |
Anthropic's scanner skips several cases. It skips pre-existing skills, Claude-created skills, MCP-shared skills, MCP servers and hooks. It skips orgs on CMEK, ZDR or HIPAA, and the Skills API.
The setting path differs between two Anthropic sources. The scanning Help Center article gives Organization settings > Plugins & skills > Policy. The enterprise skills guide gives Organization settings > Skills.
Every scanner has limits. Anthropic says a pass "isn't a guarantee that a skill is safe in every respect." The dev.to author tested Skill Defender on a malicious skill and got "CLEAN. 0 findings." (community-reported). OWASP lists this gap as AST08 Poor Scanning. Bitdefender AI Skills Checker and NVIDIA SkillSpector exist as well; we have not reviewed them.
What is the OWASP Agentic Skills Top 10 (AST10)?
The OWASP Agentic Skills Top 10 (AST10) lists the ten most critical security risks in agent skills. It runs from AST01 Malicious Skills to AST10 Cross-Platform Reuse. The current version is 1.0-2026.
| ID | Risk | Severity | Key mitigation (OWASP) | What our review checks |
|---|---|---|---|---|
| AST01 | Malicious Skills | Critical | Signing, registry scanning | Every file read |
| AST02 | Supply Chain Compromise | Critical | Provenance | Publisher, repo, pinning |
| AST03 | Over-Privileged Skills | High | Least privilege | Grade C trigger |
| AST04 | Insecure Metadata | High | Safe parsers | Frontmatter read, not fuzzed |
| AST05 | Untrusted External Instructions | High | Content pinning | Network calls listed |
| AST06 | Weak Isolation | High | Sandboxing | Out of scope for a file review |
| AST07 | Update Drift | Medium | Immutable pinning, hashes | Pinned commit |
| AST08 | Poor Scanning | Medium | Multi-tool pipeline | Manual read of every file |
| AST09 | No Governance | Medium | Inventories | Out of scope for one skill |
| AST10 | Cross-Platform Reuse | Medium | Universal YAML format | Verified vs claimed agents |
Ken Huang and Fabio Cerullo lead the project. OWASP frames the scope: "MCP = how the model talks to tools; AST10 = what those tools actually do." That line explains how skills differ from MCP servers on the security side.
The Cloud Security Alliance's five CISO risks map onto these rows. Skill sprawl is AST09, supply chain poisoning is AST02 and over-privilege is AST03. Markdown payloads fall under AST01, and portability falls under AST10.
Those checks apply to any skill. Two cases sit beside them: securing the agent itself, and OpenClaw's registry.
How do you secure Claude Code itself?
You secure Claude Code itself with permission prompts, workspace trust and deny rules. Vet every skill and MCP server before you add it. The /security-review command checks your branch for vulnerabilities.
Anthropic's Claude Code security page covers the permission-based architecture, prompt injection protections, MCP security and best practices. Admins can deny Skill or Skill(name *) in permission rules. The allowManagedPermissionRulesOnly setting ignores skills' allowed-tools, from v2.1.282. The disableSkillShellExecution setting belongs in managed settings. Datadog adds one habit: "You should always review the contents of a repository before opening it in Claude Code."
Pro, Max and Console users get /security-review and a GitHub Action. Claude Security, in public beta on Enterprise, scans repositories you own. Scanning your own code is a separate topic. To install a skill you have checked, upload a vetted skill to Claude.
Are OpenClaw and ClawHub skills safe?
No, OpenClaw skills from ClawHub are not safe by default and carry the highest documented risk. The ClawHavoc campaign planted 341 malicious skills there in three days. OWASP's final tally reached 1,184 across 12 publisher accounts.
OpenClaw is an open-source agent, and ClawHub is its public skill registry. Snyk's policy table puts all of ClawHub far above the skills.sh top 100. Prompt injection appears in 2.6% vs 0.0%, and secrets in 10.9% vs 2.0%.
Common questions
Are security skills safe because they do security work?
No, they run with your permissions like any skill, and a timonweb review found one of five worth installing. Semgrep Rule Creator, a security skill we reviewed, is Recommended (76), grade A, yet fetches seven doc pages.
Should I use Claude Code skills?
Yes, for repeat tasks, after you vet each one.
Are Anthropic's own skills safe?
No, not by default; Anthropic counts itself a trusted source, yet our grades still vary. Frontend Design holds grade A, and Skill Creator holds grade C.
Does Claude scan skills automatically?
No, only on Enterprise plans with scanning switched on. The Skills API is not scanned.
Can a skill steal my API keys?
Yes, when it can read the keys and reach the network. Datadog's demo skill read a GitHub token and uploaded it (vendor-reported).
Is a skill with no scripts safe?
No, it is safer but not safe, because instructions still steer tools. Find Skills holds grade A and still tells the agent to run a CLI.
Does a safety grade mean the skill was tested?
No, grades come from reading the files, not from running the skill's code.
Are skills safer than MCP servers?
No, neither is safe by default. Our comparison answers skills or MCP servers: which is safer.