Scan and review a Claude Code Skill before installing it.
Claude Skills and Claude Code Skills are not passive plugins. A Skill contains natural-language instructions that influence how Claude behaves, and Claude may already have access to files, shell commands, network calls, and environment variables, depending on the tools and permissions approved for that session. A malicious or poorly written Skill can induce Claude to:
Public registry data, not a Claude-only sample, illustrates the broader Agent Skill supply-chain risk. In a February 2026 study of 3,984 Skills collected from ClawHub and skills.sh, Snyk reported that 534 Skills (13.4%) triggered at least one critical-severity security policy. Researchers separately confirmed 76 Skills containing malicious payloads. These figures reflect Snyk's dataset and methodology, not the prevalence of malicious Claude Skills.
Use this checklist with the scan results to inspect the Skill before installing, whether or not the scanner flags anything.
Read the model-instruction section of the Skill. Look for instructions that change Claude's default behavior, especially instructions to ignore safety guidelines, suppress disclaimers, or treat the Skill's author as inherently trusted.
If the Skill or its associated configuration declares tool permissions, check which tools are listed. A Skill that only provides code-review advice should not need Bash or WebFetch. Be cautious of broad permissions like unrestricted shell access.
Check whether the Skill references executable scripts, unpinned package versions, or install commands. A script that runs curl | bash or pulls dependencies from an unverified source is a supply-chain risk.
Search for URLs, webhooks, or API endpoints in the Skill content and any bundled scripts. A data-exfiltration pattern often looks like reading a credential file and POSTing it to an external server.
Claude may have access to your working directory and environment. Check whether the Skill references file paths like ~/.ssh, .env, ~/.aws/credentials, or system keychains, especially in combination with network access.
Check the author, source repository, and publication date. A Skill from an unfamiliar author with no commit history, no public repository, or no community feedback deserves extra scrutiny, regardless of what the scan score says.
SkillSecurity performs static analysis on the Skill content and any bundled files.
Each report combines a Skill Safety Score and recommendation with findings, evidence, file locations, and scan coverage, plus options to export or share the result.
Use the generic AI Skill Scanner and report guideIssues were found that could impact safety or lead to unintended behavior.
Inspect the finding evidence and the skipped file before trusting this Skill.
readFile("~/.ssh/id_ed25519")High confidencescripts/review.ts:42Use the scan as one input to the decision. Review the findings and skipped files, then inspect the Skill's source, requested permissions, and outbound data flows before installing.
Yes. A Skill that uses novel obfuscation, encrypted payloads, or techniques outside the current rule pack may receive a higher Skill Safety Score than it deserves. Review the score alongside the findings, skipped files, and Skill source.
SkillSecurity scans SKILL.md and bundled Skill files, not MCP servers. An included or referenced MCP configuration may appear in the report as a bundled configuration risk.
Free Skill security scan
Paste SKILL.md content, upload a file or zip, or submit a supported GitHub URL. Review the findings and coverage before deciding whether to install.