Are Agent Skills safe to install?
Agent Skills are as safe as the person who wrote them, because a skill is instructions plus optional scripts that your agent follows with your permissions. Anthropic's advice is to use skills only from trusted sources, meaning ones you created yourself or obtained from Anthropic, and to audit anything else thoroughly before use.
The security section of Anthropic's Agent Skills overview explains why: "a malicious Skill can direct Claude to call tools or run code in ways that don't match the Skill's stated purpose." Depending on what access Claude has, Anthropic warns this could lead to data exfiltration or unauthorized system access.
The risk is not theoretical. Skill registries have already hosted hundreds of malicious skills, and researchers have shown that automated scanners can be fooled. None of that means you should avoid skills. It means you treat a skill like any other software you install: check where it came from, read it, and limit what it can touch.
What can a malicious skill do?
A skill works through the tools your agent already has, so the damage depends on where it runs. Anthropic's overview notes that in Claude Code, skills "have the same network access as any other program on the user's computer," while API skills run in a container with no network access.
| Risk | How it works | What to look for |
|---|---|---|
| Prompt injection | Text in SKILL.md or a reference file tells the agent to do something the user didn't ask for |
Instructions unrelated to the skill's stated job, hidden or encoded text |
| Malicious scripts | A bundled script runs when the skill tells the agent to run it | Downloads, encoded commands, reads of credential files |
| Fake prerequisites | The skill tells you or the agent to install a tool first, which is the malware | "Install X before using this skill" steps that fetch binaries or archives |
| Remote instructions | The skill fetches instructions from a URL at run time, so content can change after review | curl, wget or fetch calls to addresses you don't recognize |
| Over-broad permissions | In Claude Code, allowed-tools pre-approves tools for the turn that invokes the skill |
Wide grants such as unrestricted Bash |
| Supply chain changes | An update replaces the version you reviewed | Unpinned installs with auto-update on |
Claude Code adds two details worth knowing. The Claude Code skills docs say a skill's !`command` lines run before Claude sees the skill, checked against your permission rules, and that project skills apply their allowed-tools even in a -p run in an untrusted folder. Plugins go further: Anthropic's plugin security page says a plugin's hooks, monitors and MCP servers run outside the sandbox with your full user permissions.
What has actually gone wrong so far?
Several primary research reports document real attacks on skill registries in 2026:
- ClawHavoc (February 2026). Koi Security disclosed a campaign on ClawHub, the OpenClaw registry. Palo Alto Networks Unit 42 says the disclosure "documented 341 malicious skills," that Trend Micro confirmed skills distributing the Atomic macOS Stealer (AMOS), and that the delivery method was a "Base64-encoded curl-pipe-bash dropper": the skills "embedded a fake prerequisite block" that told the agent to decode and run a remote payload.
- ToxicSkills (5 February 2026). Snyk scanned 3,984 skills from ClawHub and skills.sh. It reported that "13.4% of all skills, or 534 in total, all contain at least one critical-level security issue," and confirmed 76 malicious payloads through human review. Techniques included password-protected archives, Base64 obfuscation and remote instruction loading.
- Scanner evasion (reported June 2026). Unit 42 documented skills that kept passing ClawHub's checks after it added VirusTotal and ClawScan screening, including one whose README was padded with about 22 MB of characters to exceed scanner size limits.
These figures come from different studies with different methods and dates, so don't add or compare them directly. The pattern is consistent, though: attackers disguise malware as useful skills and rely on users not reading the install steps.
What do skills.sh, ClawHub and Claude scan for?
Most places that distribute skills now run some automated check. Here is what each publicly documents:
| Platform | What it checks | What happens to a flagged skill |
|---|---|---|
| skills.sh | Audits from Gen Agent Trust Hub, Socket and Snyk, shown on each skill page | Skills flagged as malicious are hidden from the leaderboard and search; a warning shows before install |
| ClawHub | Automated checks on each published release, with scan state on the detail page | Held or blocked releases can disappear from public listings |
| Claude Enterprise | Skill and plugin security scanning for skills uploaded in claude.ai and Cowork | Risky skills show a caution banner; malicious ones are blocked |
| Claude Code marketplaces | No review of third-party marketplaces | A trust warning before every install |
GitHub CLI gh skill |
No verification | You can run gh skill preview first |
Vercel's skills.sh audit announcement covers its process, and Anthropic's help article on provisioning skills covers Enterprise scanning. Anthropic's overview notes that this scanning doesn't cover skills uploaded through the Skills API or the Claude Console.
Claude Code's install warning is worth reading once in full: "Anthropic does not control what MCP servers, files, or other software are included in plugins and cannot verify that they will work as intended or that they won't change."
Can a skill scanner catch everything?
No. In June 2026, Trail of Bits published results showing it built malicious skills that passed ClawHub's detector, Cisco's skill scanner and all three scanners on skills.sh. The team wrote that "it took us less than an hour to conceive and implement three of the four malicious skills." The tricks were ordinary: a large block of newlines to push code past a scanner's inspection window, real instructions hidden inside a .docx file (a ZIP archive), and compiled Python bytecode that didn't match its visible source.
A Cloud Security Alliance research note from 29 June 2026 reached the same conclusion: treat current scanners as one detection layer, not as a gate. Instructions written in plain language are especially hard for static code analysis to judge.
So use audits to rule skills out, not to rule them in. A High Risk label is a strong reason to skip a skill. A Safe label means the scanners found nothing, which is not the same as nothing being there.
How do you check a skill yourself before installing it?
A careful read of a small skill takes about five minutes. Work through this list:
- Check the source. Who maintains the repo? Is it the vendor it claims to be? Watch for names one letter off from popular skills.
- Read all of
SKILL.md. Every instruction should serve the skill's description. Be suspicious of steps that install software, change config files or disable safety checks. - Open every bundled file. Read scripts line by line. If the folder holds archives (
.zip,.docx) or compiled files (.pyc, binaries) you can't read, skip the skill. - Search for network activity. Look for
curl,wget,http, piping intoshorbash, and fetches of remote instructions. - Search for hidden text. Look for long Base64 strings, unusual Unicode and HTML comments in Markdown.
- Check the frontmatter. In Claude Code, an
allowed-toolsline pre-approves tools. Make sure it's narrow and matches the job. - For plugins, list everything. Anthropic's security page suggests
claude --plugin-dir <dir> plugin details <name>to print each skill, hook and MCP server, then readinghooks/hooks.json,.mcp.jsonand every file inbin/. - Read the audit results. On skills.sh, check all three providers and the dates.
Testing a skill helps too, though it proves behavior, not safety. Anthropic's own eval docs say a passing suite "says nothing about whether the plugin is safe." See how to test agent skills for that side.
How do you limit the damage if a skill turns bad?
Assume one day you will install something you shouldn't have. These settings keep the blast radius small:
- Pin versions. GitHub's
gh skillchangelog documents--pin, and pinned skills are skipped on update. Claude Code marketplace entries accept a Gitreforsha, and archive sources can carry asha256that Claude Code checks. - Control updates. Auto-update is off by default for third-party Claude Code marketplaces. Leave it off for anything you haven't reviewed, and re-read the diff before you update.
- Restrict sources in a team. Claude Code admins can set
strictKnownMarketplacesto an allowlist,disableSkillShellExecutionto stop!commands in skills, andallowManagedPermissionRulesOnly(v2.1.282 or later) to ignoreallowed-toolsin project and personal skills. The organization plugin settings cover the marketplace allowlist, and the Claude Code skills docs cover the other two keys. - Require explicit use.
disable-model-invocation: truein Claude Code means a skill only runs when you type its name. Codex hasallow_implicit_invocation: falsein a skill'sagents/openai.yamlfor the same purpose. - Sandbox risky work. Run untrusted skills in a container or VM without your credentials.
- Rotate secrets if in doubt. Snyk's advice after ToxicSkills was to rotate credentials for any skill that handled keys or cloud access.
For the wider picture of hostile text reaching your agent, see prompt injection in coding agents and Claude Code security.
Keep reviewed copies you control
The safest skill is one you've read and that can't change without you noticing. Kipt keeps your prompts and skills as Markdown in a private GitHub repo you own, so a reviewed skill stays put and every later change shows up as a commit. You can import a skill you've vetted from a GitHub link, a folder or a .zip, then install your whole library into Claude Code or Codex with npx skills add https://github.com/<you>/<repo>.git --all -g.