A skill looks like a text file, and mostly it is one. But three features can make it run code on your machine: frontmatter can pre-approve tools, a line can run a shell command before the model reads the skill, and hooks can keep running for the rest of the session. None of that shows in a one-line install command. Researchers have reported hundreds of malicious skills in public registries, and the standard's own security guidance is still only a proposal. So the check falls to you. These ten steps take about ten minutes for a typical skill.
Key Takeaways
allowed-toolsis a pre-approval, not a limit. Claude Code's docs say: “It does not restrict which tools are available: every tool remains callable.”- Dynamic context runs before the model sees the skill, and never prompts. A command that isn't approved aborts the skill, but a skill can pre-approve its own command, so read those lines yourself.
- Hooks run with your full user permissions. A skill's hooks keep running for the rest of the session, and plugin hooks run outside the sandbox.
- A scanner result is evidence, not clearance. In our test, SkillSpector's static scan scored one well-known skill 100/100, mostly for unpinned commands and table spacing, and its report on another never mentioned an unscoped
Bashgrant. One preprint found a packing technique got past all eight scanners it tested more than 90% of the time. - The Agent Skills standard has no security guidance yet. Anthropic proposed it for the roadmap on October 22, 2026. Claude Code's own docs do cover reviewing plugins.
Why a Skill Isn't Just a Text File
Three mechanisms matter, and each one is documented by Claude Code.
Pre-approved tools. allowed-tools lets the listed tools run “without prompting you for approval” during the turn that invokes the skill. Workspace trust doesn't gate it: a project skill's allowed-tools applies “even in a -p run in a folder you've never trusted.”
Dynamic context. The !`command` syntax “runs shell commands before the skill content is sent to Claude.” The docs add: “Injected commands never prompt for permission while the skill renders.” That doesn't mean anything can run. Outside auto mode, a command whose permission check returns anything other than allow aborts the skill. But the docs tell authors to pre-approve these commands with allowed-tools, so a skill can supply that permission itself. Your deny and ask rules still override it. In auto mode, a command that would need approval goes through auto mode's usual checks instead.
Hooks. A skill's hooks register when it's invoked and keep running “for the rest of the session.” Command hooks “execute shell commands with your full user permissions.”
For plugins, the docs say it directly: “A Claude Code plugin you install can execute arbitrary code on your machine with your user privileges.”
The 10-Minute Check
Run these from inside the skill's folder, or read the same files on GitHub before you install anything.
| # | Check | How |
|---|---|---|
| 1 | Read allowed-tools as “runs without asking.” Flag unscoped Bash and broad grants like Bash(python3 *) or Bash(curl *). | Read the YAML header |
| 2 | Find dynamic-context lines and blocks. Each one runs before the model reads the skill. | grep -n '!`\|^```!' SKILL.md |
| 3 | Look for hooks: and read every hook under it. Not all of them are shell commands. | Read the YAML header |
| 4 | Read the instructions in SKILL.md and any files it points to, because a malicious skill can be plain text. Then open every file in scripts/, and bin/ for plugins. | Read each file |
| 5 | Flag fetch-and-execute patterns: curl or wget into a shell, base64 with eval, password-protected archives, and “install this prerequisite first.” | grep -rnE 'curl|wget|base64|eval' . |
| 6 | For plugins, read hooks/hooks.json, .mcp.json and bin/. The docs say the Will install section “shows that a hook exists but not what it runs.” | Read the plugin folder |
| 7 | If npx skills add shows a risk table, read it. No table means no rating was shown, not that it's safe. Skip --yes on a first install. | Run without -y |
| 8 | Before running Claude Code in a repo you didn't write, check for skills and commands it brings with it, including nested and symlinked ones, and read .claude/settings.json. | find -L . -path '*/.claude/skills/*' -name SKILL.md -o -path '*/.claude/commands/*' |
| 9 | For skills with side effects, prefer disable-model-invocation: true, so they run only when you call them. | Read the YAML header |
| 10 | Check again after updates. Most official-marketplace plugins auto-update by default, so “the files you reviewed can change on disk.” | Turn off auto-update where you haven't vetted |
For teams: set "disableSkillShellExecution": true in managed settings, where users can't override it. Each dynamic-context command is then replaced with a notice instead of being run. Bundled and managed skills are not affected.
What Scanners Can and Can't Tell You
A scanner is a fast second opinion on the checks above. Two recent open-source tools from NVIDIA answer different questions, and it's worth keeping them apart.
SkillSpector asks: is this risky? It runs static analysis, plus an optional AI review that needs a provider key. It needs Python 3.12 or later:
uv tool install git+https://github.com/NVIDIA/skillspector.git
skillspector scan ./my-skill/ --no-llmIt reports a score from 0 to 100 and a recommendation: SAFE up to 20, CAUTION up to 50, and DO NOT INSTALL above that. Two details matter. By default its exit code treats SAFE and CAUTION the same, so a CI gate needs --fail-on-findings to stop on any finding. And its own notes for version 2.13.4 (November 4, 2026) are plain about the limits: it inspects sources “without executing uploaded code,” and “Dependencies outside the uploaded skill and unprovable runtime behavior remain incomplete.”
SkillEvaluator asks: is this any good? It starts with a quality check that needs no API key, then can “compare live runs with and without a skill.” A good score says nothing about safety, and its README says so: “Security needs scanners; agent impact needs live evaluation.”
What happened when we ran it
On November 6, 2026, we scanned two skills from our catalog with SkillSpector 2.13.4 and --no-llm, so the optional AI review did not run. We picked one with a dynamic-context line and one with an unscoped Bash grant.
| Skill | Score | Recommendation | Findings | allowed-tools |
|---|---|---|---|---|
| shadcn/ui | 100/100 | DO NOT INSTALL | 158 | shadcn CLI only |
| Differential Review | 7/100 | SAFE | 1 | Unscoped Bash |
So we read the flagged lines. On shadcn/ui, 123 of the 158 findings came from one rule about unpinned commands, mostly npx shadcn@latest, and another 23 flagged the spacing in Markdown tables as “whitespace padding.” The seven high-severity findings pointed at docs for the CLI's --force and --overwrite flags, a table row showing where Codex keeps its config, a comment about inspecting preset state, a React example using dangerouslySetInnerHTML, and a file the parser couldn't fully inspect. We saw no sign of malicious intent in those lines, though that isn't a full audit. The unpinned @latest is a fair point: that command can change without the skill changing. But the report flagged the skill's one dynamic-context line only for that, not for running before the model reads the skill.
Differential Review's one finding was a heading in a reference document: “External call without checking success.” Nothing in its report mentioned the unscoped Bash grant, the first thing check 1 would flag.
Two skills aren't a benchmark, and the AI review might change both results. We wouldn't read either label as a verdict on the skill. What the scores gave us was a list of places to look.
How to read a result. Treat a finding as a reason to read that part of the skill, and a clean score as one more data point. Its README describes the static stage as high recall with moderate precision, so expect false positives. And a scanner can only judge what's in the folder: the preprint in the research section below got past every scanner it tested by unpacking its payload at run time. That's why the checks above stay on the list even if you scan.
What We Found in Our Own Catalog
On November 6, 2026, our catalog listed 195 skills, and we carried the SKILL.md text for 161 of them. We searched those files for the same things the checks look for. Finding one of these doesn't make a skill bad. It tells you what to read.
- 7 skills set
allowed-tools. 5 name specific commands, though not all narrowly: shadcn/ui pre-approves only runs of the shadcn CLI, while Playwright Skill pre-approves anynodeornpmcommand. 2 pre-approveBashwith no scope: Semgrep Rule Creator and Differential Review. That can suit what they do, but during the turn that invokes them, any shell command your deny and ask rules don't catch runs without asking. - 1 skill uses dynamic context. shadcn/ui runs
npx shadcn@latest info --jsonto read your project setup, and pre-approves that CLI itself. This is the intended use, and it also shows the reach: the command runs before Claude reads the skill. - 0 of the 161 declare
hooksin their frontmatter. Planning with Files, which we list without carrying its text, does. It registers five hook events and pre-approvesBashwith no scope, and its repo also shipshooks/hooks.json. - 4 mention a curl-to-shell install of a CLI: Hugging Face CLI, Render Deploy, Varlock and Sentry Skill. That's how those vendors distribute their tools, and all four URLs are on the vendor's own domain or GitHub org. It's still code you run unread unless you open the script first.
How Other Tools Handle It
- Codex. Version 0.164 (October 23, 2026) ties a plugin hook's approval to the plugin's contents. The pull request gives the reason: “Declaration-only approval therefore lets changed plugin code run under an existing hook approval.” Now, changed contents need approval again.
- Claude Code. The plugin security docs describe reviewing a plugin before you install it, and they describe no approval step for each hook.
- npx skills. It shows an installation summary and, for public GitHub repos with partner data, a risk table from Gen, Socket and Snyk. The table is advisory and never blocks an install. The summary doesn't show the SKILL.md.
What the Research Found
These are the researchers' findings, not ours. We didn't reproduce them.
- Datadog Security Labs (May 2026). A skill posing as a leaderboard tried to send the user's GitHub token out. Datadog reports the model refused it as plain instructions, but it ran once Datadog's test copy moved it into dynamic context and pre-approved
Bashthroughallowed-tools. That was the Claude Code of May, though current docs still describe pre-approving these commands that way. - Snyk ToxicSkills (February 2026). Of 3,984 skills from ClawHub and skills.sh, Snyk reports that 13.4% had at least one critical issue, and it confirmed 76 skills with malicious payloads in their markdown instructions.
- Koi Security, via The Hacker News (February 2026). 341 malicious skills among 2,857 on ClawHub, with 335 using fake prerequisites to install a macOS stealer. We read the news report, not Koi's original.
- “Cloak and Detonate” (preprint, July 2026). Across eight scanners and 1,613 malicious skills, a self-extracting packing technique got past every scanner more than 90% of the time.
- “Agent Skills in the Wild” (preprint, January 2026). Skills bundling scripts were 2.12 times more likely to contain a vulnerability than instruction-only skills.
What a Directory Can and Can't Do for You
That includes this one. We select what we list, check install commands against each skill's source, and copy MCP configuration from the maker's own docs. New submissions also get automated checks.
We don't audit every script in every skill, and we don't review each upstream commit. Listing here doesn't mean a skill is safe for your machine. Our methodology sets out where that line sits. The security guidance Anthropic proposed when it moved the standard to the Linux Foundation hadn't been published when we checked, so for now, these checks are yours to run.
Frequently Asked Questions
How We Verified This
Checked on November 6, 2026. Claude Code's behavior comes from its skills, hooks, plugin security and plugin discovery docs. The npx skills behavior comes from its source code at version 1.7.6. The roadmap comes from Anthropic's announcement. Quotes were compared against the raw text of each source.
The catalog counts come from the SKILL.md text we fetched from upstream, searched by script, so a skill can change after that date. The scans used shadcn-ui/ui at commit 42f3bb6 and trailofbits/skills at commit e4dd0bb. We read every flagged line except the unpinned-command findings, which we sampled. We tested the check 2 and check 8 searches on sample files on macOS, and they can still miss unusual layouts. We didn't reproduce any attack, and the Claude Code details here may not apply to other agents. For example, the Codex skills docs we read don't say whether skill scripts run in its sandbox.
Now It's Your Turn
None of these checks proves a skill is safe. They tell you what it can do on your machine and whether you're comfortable with that, which no star count or scanner badge can decide for you. Read the file, run a scanner if you want a second opinion, and check again after updates. Then browse the skills directory with the same questions in mind.
Browse All Skills