Are Claude Skills Safe? What Scanning 103,619 of Them Taught Us

Last updated: September 2026

Mostly, yes — but not because anyone is checking. We run every skill indexed by Skills Directory through static analysis: 103,619 skills from 5,316 public repositories as of August 31, 2026. 86.2% came back with zero security findings of any severity. But 3.8% — 3,919 skills — carry at least one critical-capability finding: piping remote scripts into a shell, sending environment variables to an external URL, reading SSH keys, or embedding prompt-injection strings. And the signal most people use to judge safety — GitHub stars — predicts almost nothing: the clean-grade rate is essentially flat from 0-star repos to 1,000+-star repos.

The full tables and methodology live in the companion data report: We Scanned 103,619 Claude Skills for Security Issues. Here's What We Found. This page is the practical version — what actually goes wrong, how to check a skill yourself in two minutes, and what a security grade does and doesn't tell you.

Why "safe" is even a question

A Claude skill is a markdown file. That sounds harmless until you remember what reads it: an agent with your shell, your filesystem, your environment variables, and often your gh auth token. The skill's instructions become the agent's instructions. Installing one is closer to adding a dependency than to bookmarking a prompt.

This isn't theoretical. Snyk's ToxicSkills research audited 3,984 skills from ClawHub in February 2026 and found confirmed malicious payloads in the wild — credential theft, backdoors, exfiltration. In their dataset, 91% of confirmed-malicious skills used prompt-injection techniques alongside their payloads. Our corpus is roughly 26x larger and tells a calmer but compatible story: the ecosystem is mostly fine, and the part that isn't fine is exactly the part no one reads before installing.

What can actually go wrong

Three failure modes account for nearly all of the sharp end of our dataset.

Prompt injection

293 skills in our corpus contain prompt-injection patterns. 128 include a literal "ignore previous instructions." 159 impersonate system messages. 24 invoke a fake "developer mode" to talk the agent out of its constraints. There is no legitimate reason for an installable skill to do any of those things — a skill is supposed to describe a task, not argue with the model about its rules. Of everything we scan for, this category is the closest thing to a smoking gun, and it's also the one traditional security tooling misses entirely, because the payload is prose.

Credential exfiltration

1,444 skills triggered exfiltration rules. The two worst patterns: 785 skills send environment variables or credentials to an external URL, and 768 match the exact credential-exfil-via-HTTP pattern documented in the ToxicSkills study. Add 186 skills that read or reference SSH private keys and 264 with credential-access findings generally. Some of these are deploy workflows doing their jobs. Static analysis can't distinguish a deploy script from a stealer with a README — which is precisely why the capability should be visible before you install, not discovered after.

curl | bash and the runtime supply chain

The biggest category by volume. 1,172 skills pipe downloaded output straight into a shell interpreter, and 1,168 download and execute remote scripts — the classic supply-chain primitive. Most are installers (curl -fsSL https://bun.sh/install | bash appears constantly), not attacks. But an unpinned remote script executed as a side effect of "installing a markdown file" is a supply-chain decision someone made on your behalf. Quieter and larger still: 9,505 skills install packages at runtime, meaning their real dependency tree resolves at execution time, on your machine, outside anyone's scan.

One more number worth internalizing: popularity fixes none of this. Skills from 0–9-star repos grade A or B 97.8% of the time; skills from 1,000+-star repos, 98.9%. Stars measure distribution, not review — and distribution is what an attacker wants.

How to check a skill yourself (2 minutes)

You don't need a scanner to catch most of the above. A skill is text; read it like a diff you're about to merge.

1. Read the whole SKILL.md. The red flag isn't complexity — it's instructions addressed to the model instead of describing the task: "ignore previous instructions," [SYSTEM], "developer mode." Legitimate skills never need these.
2. Grep for network and credential surfaces. One command covers most of it:

   grep -rnEi 'curl|wget|https?://|\.env|\.ssh|\.aws|token|keychain' ./skill-folder/
   

   Every hit should have an obvious reason tied to the skill's stated purpose. A PDF-formatting skill has no business near ~/.ssh.
3. Check what executes. Look for | bash, | sh, npm install / pip install at runtime, and any bundled scripts/ directory — read those files too. They ship with the skill and run with your permissions.
4. Look for things hiding from you. Large base64 blobs, hex-encoded strings, password-protected archives. These exist in skills for exactly one reason: to keep scanners (and you) from reading the payload.
5. Check the scan, then decide. Every skill on Skills Directory has a grade, score, and line-numbered findings on its page. For a baseline of what clean looks like, see Ponytail Audit, Expected, or Caveman Discover — all Grade A. If a skill's page shows findings its description doesn't explain, skip it. If you find one that's outright malicious, report it.

Two minutes. Less time than the install instructions for most skills.

What our grades mean — and what they don't

Every skill goes through 36 static-analysis rules — 120 detection patterns — across 11 threat categories: execution, exfiltration, credentials, filesystem, network, persistence, supply chain, obfuscation, prompt injection, hidden helpers, and known threats. Skills start at 100 and lose points per finding by severity; the score maps to a grade:

Grade	Score	Plain English
A	90–100	Our rules found nothing significant
B	75–89	Minor concerns
C	60–74	Review before installing
D	40–59	Significant concerns
F	0–39	Critical findings

Across the corpus: 95.0% grade A, 776 skills (0.7%) grade D or F. Full distribution and per-rule counts are in the data report; the scoring details are on the security page and methodology page.

Now the limits, stated plainly, because a grade you overtrust is worse than no grade:

• This is static analysis, not sandboxed execution. We detect capability, not intent. A skill that curls the Bun installer into bash gets flagged the same way a downloader-stager does, because on paper they are the same operation.
• False negatives exist. Obfuscated instructions, payloads fetched at runtime, and adversarial prose that reads as benign to a pattern-matcher will get through. Snyk's core finding was exactly this: the paradigmatic malicious skill hides in natural language.
• An A is a first-pass filter, not an audit. It means our rules found nothing — not that nothing is there. That's why the checklist above applies to everything you install, including skills we grade A.

FAQ

How to check if a Claude skill is safe?

Read the SKILL.md and any bundled scripts before installing. Grep for network calls (curl, wget, URLs), credential paths (.env, .ssh, tokens), pipe-to-shell (| bash), and instructions addressed to the model ("ignore previous instructions"). Then check its scan: every skill on Skills Directory shows a security grade and the specific findings behind it.

Can Claude skills steal my data?

Yes — that's a capability, not a hypothetical. In our 103,619-skill corpus, 785 skills send environment variables or credentials to an external URL and 768 match the credential-exfiltration pattern from Snyk's ToxicSkills study. Skills run with your agent's access, so a malicious one can read what your agent can read and send it wherever it likes. The mitigations are boring and effective: read before installing, and prefer skills with a published scan.

Is skills.sh safe?

skills.sh is a skills directory with an install CLI, like us. Installing through it is as safe as the skill you pick — the install rail itself doesn't audit skill contents, and to our knowledge doesn't publish per-skill security scans. That's the main difference with Skills Directory: we scan everything we list and publish the grade and findings. Whichever source you use — including us — read the SKILL.md first.

Are Claude skills just markdown files?

Mostly, and that's exactly why they matter: markdown is the instruction set your agent executes with real permissions. Many skills also bundle executable scripts and reference files, and 9,505 skills in our corpus install packages at runtime. "Just markdown" is the supply chain's best disguise.

Do GitHub stars mean a skill is safe?

No. Across 103,619 skills, the A/B-grade rate barely moves from 0-star repos (97.8%) to 1,000+-star repos (98.9%). Stars measure popularity, and popularity is distribution — the thing an attacker optimizes for. Judge a skill by its contents and its scan, not its repo's follower count.

---

All numbers are from our scan of 103,619 skills across 5,316 public repositories, current as of August 31, 2026. The full breakdown — grade distribution, per-rule counts, star-bucket analysis, duplication clusters — is in the security report. Browse scanned skills at skillsdirectory.com/skills.