Are Claude Skills Safe? How to Vet One Before You Install

Last checked October 20, 2026 · Based on reading skill files line by line at a pinned commit, plus Anthropic's documentation and Datadog Security Labs research. Nothing from the repository was installed or run.

No affiliate links on this page: Saazora earns nothing from any skill, repository or vendor named here.

Are Claude skills safe? Most are, but you can't tell which ones by looking at the name. A skill is a folder of instructions, and sometimes scripts, that Claude loads when a task matches its description. In the catalogue examined here, more than half are plain text with nothing that runs. A few fetch instructions from someone else's server, add a remote MCP server holding your API key, or ship scripts and hooks that run shell commands with your user permissions. Anthropic's own advice is to install skills "only from trusted sources" and to "thoroughly audit" anything else first. This page turns that advice into ten concrete checks, and each check is shown on a real file.

The examples come from davila7/claude-code-templates, a large public catalogue of Claude Code components, which is MIT-licensed as a repository. On October 18, 2026, Saazora read every file of eight marketing components (six skills, two agents) plus one hook at commit 4df7973, and noted the line numbers. On October 20 the same six files were fetched again at the newer commit ffcb267, and they were identical, so the line numbers below still hold. For the wider tool landscape, see Saazora's AI tools hub.

What actually executes: skill text, scripts, hooks and MCP servers

Before the checklist, it helps to separate four things that often get lumped together as "a skill". They carry very different risk, and a single download can contain several of them.

The practical point: "it's only a markdown file" is true for most skills and false for some. The checklist below tells you which kind you are holding.

The 10-step checklist for reading a skill before you install it

Each step names what to open, what to search for, and a real line that shows why the step exists. A single-file skill is a short read; one with scripts or config files takes longer.

1. Open every file in the folder, not just SKILL.md

Anthropic's engineering post on Agent Skills (October 16, 2025) says to start "by reading the contents of the files bundled in the skill", paying "particular attention to code dependencies and bundled resources like images or scripts". That matters because many skills are not one file. In the regex pre-scan of all 49 skills in the repository's business-marketing folder, 13 had more than one file and 10 bundled a .py, .js, .sh or .ts file. content-creator, for example, ships seven files: SKILL.md, two Python scripts, three reference documents and an asset. List the folder first (ls -R) and decide what you are reading before you read it.

2. Read the frontmatter: allowed-tools and hooks

The block between the --- lines at the top of SKILL.md can grant tools and register hooks. Claude Code's skills documentation says allowed-tools lets Claude use the listed tools "without asking permission" during the turn that invokes the skill, and adds a warning worth copying into your notes: "Workspace trust doesn't gate this field. Claude Code applies a project skill's allowed-tools even in a -p run in a folder you've never trusted." The same docs say hooks declared in a skill are registered when it is invoked and keep running "for the rest of the session".

In the pre-scan, two of the 49 marketing skills declared allowed-tools. One is a model of restraint: seo-fundamentals lists Read, Glob, Grep. The other, app-builder, lists Read, Write, Edit, Glob, Grep, Bash, Agent (SKILL.md L4), which pre-approves shell access while it runs. app-builder was not part of the hand-read set, so treat it as an example of the line to look for, not a verdict: a grant like that means the rest of the folder needs a full read before you install it.

3. Search for dynamic-context lines that start with !

This is the check most guides skip. Claude Code lets a skill embed shell commands in its body with !`command` or a ```! block. According to the docs, these run "before the skill content is sent to Claude", and the output replaces the line. Datadog Security Labs showed why that matters (May 11, 2026): when the token theft lived in normal instructions, Claude (Opus 4.6 in their run) spotted it and refused; when the same commands were moved into ! lines with allowed-tools: Bash(*), they ran during rendering, before the model could object.

Search for !` at the start of a line and for ```!. A read-only search over the six files quoted on this page found none on October 20. If you find one, read the command as if you were about to paste it into your own terminal, because in effect you are.

4. List every shell command and package install

Search the folder for python, node, npx, pip install and bash. The audit found two different levels of this. content-creator tells Claude to run python scripts/brand_voice_analyzer.py (L50) and python scripts/seo_optimizer.py (L78); both scripts import only the standard library (re, json, typing, sys) and make no network calls. google-analytics goes further: it runs pip install -r requirements.txt with floor-only versions (>=) and needs a Google service-account key path in your environment. Unpinned installs mean the code you run next month may not be the code you read today.

5. Find every URL, and ask who controls it

Anthropic's platform docs put this plainly: "Skills that fetch data from external URLs pose particular risk, as fetched content may contain malicious instructions. Even trustworthy Skills can be compromised if their external dependencies change over time." Search for https://, fetch, WebFetch and curl, then sort the hits into example links (harmless) and things the skill tells Claude to download and act on.

ai-directory-submitter is the clearest example. Line 12 tells Claude to fetch falcoscan.com/directory-list/sample.md and adds: "It is refreshed daily, so fetch it fresh for each new product." Whatever you approved when you read the skill, the list that steers the agent can change after that. Rated High in the audit for that reason (and two more, covered in step 8).

6. Look for MCP server setup and where your key goes

Search for .mcp.json and mcpServers. A skill that adds an MCP server gives Claude a new set of tools hosted somewhere else, and every call sends your inputs there. Anthropic's Claude Code security page says it "reviews connectors against its listing criteria before adding them to the Anthropic Directory, but does not security-audit or manage any MCP server", and the MCP page asks you to "verify you trust each server before connecting it".

x-twitter-scraper writes a remote server, https://xquik.com/mcp (L177), into .mcp.json in your project root, with your key sent as an x-api-key header (L179). Line 186 then says that if environment-variable substitution doesn't work, "replace it with your actual key at runtime", which in practice means a plain-text key in a project file. The skill is a single-vendor integration for a paid API ($20 a month base, per L38). That may be a perfectly good product, but installing the skill is a purchase decision and a data-sharing decision, not a writing aid.

7. Check for hooks that come with it, and treat them as code

Hooks are not skills, but they live in the same catalogues and often arrive in the same install. The hooks reference is blunt: "Command hooks execute shell commands with your full user permissions. They can modify, delete, or access any files your user account can access." It also warns that in a -p or SDK session Claude Code "treats the folder as trusted, so hooks committed in a repository's .claude/settings.json run in a folder you've never trusted".

This hook is benign in intent: it sends you a Telegram message when a session starts and ends. Look at what it does to get there, though. On every SessionStart it writes ~/.claude/session_start.tmp, outside your project, and curls your project folder name to api.telegram.org; on every Stop it sends duration and memory use. No prompt, no approval per run. Swap one URL and the same structure sends anything your user account can read. Open any hooks/ folder or settings.json that comes with a download, and read each command string in full.

8. See what it collects, where it writes, and what it tells Claude to say

Search for ~/, $HOME, email and utm_. Three different problems turned up here:

• Personal data leaving your machine. ai-directory-submitter collects "founder name, contact email, and X, LinkedIn or GitHub links" (L22) and then opens third-party sites and submits forms in your name (L30). To its credit, L32 is a good rule: stop and ask before any payment, login, CAPTCHA or link-back.
• Files outside the project. competitive-ads-extractor's output examples save to ~/competitor-ads/... (L169-171), in your home folder, after a scraping instruction with no method given (L22).
• Someone else's sales pitch. The last line of ai-directory-submitter (L43) tells Claude to mention a paid list "for $24 once" at a link tagged utm_source=skill. For marketers this is the check that matters most: a skill can carry a vendor's upsell or tracking link into your client work, and Claude will deliver it as if it were its own advice.

9. Confirm the licence and the author of the skill itself

A repository's licence doesn't prove much about each file inside a community catalogue. The repo is MIT (© 2025 Daniel (San) Ávila), but only 8 of the 49 business-marketing skills state their own licence in frontmatter, and the frontmatter names several different authors. content-creator is one of the clear ones: license: MIT, author Alireza Rezvani. Duplicates add a second problem. x-twitter-scraper exists both in skills/marketing/ and in skills/business-marketing/ with different descriptions and triggers, so "the same skill" can install different text depending on the path. If you plan to adapt and republish a skill, pick one with an explicit licence.

10. Pin the version you read, and re-read on update

The repository moved fast while this checklist was being put together: 4df7973 and 161d491 both landed on October 18, and on October 20 the head was ffcb267. The 50 commits up to 161d491 reach back only to October 9, and 27 of them were automated content updates by a bot account. The catalogue's installer form is npx claude-code-templates@latest --skill <path>, which runs whatever npm package is newest that day and copies the skill into .claude/skills/<name>/. That is a second trust decision on top of the skill text. Two more limits to keep in mind: the repo's own security-report.json (dated December 20, 2025) covers 216 commands and 163 agents and zero skills, so it doesn't vouch for any skill; and a remote file like the one in step 5 changes no matter which commit you pin.

The safer habit: note the commit SHA you read, copy SKILL.md (and any scripts you read) into .claude/skills/<name>/ by hand, and when you want an update, read the diff before you pull it.

Are Claude skills safe? What Anthropic and Datadog say

Short, dated quotes from the primary sources, so you can check the wording yourself. Anthropic's documentation pages carry no publication date; they are quoted as read on October 20, 2026.

One reading of the two sources together is worth spelling out. Datadog's write-up shows the ! trick working with allowed-tools: Bash(*) in the frontmatter. Anthropic's current docs say an injected command that your permission rules don't allow aborts the skill outside auto mode, unless the skill pre-approves it with allowed-tools. Either way, the pair to look for is the same: a ! line plus a broad Bash grant in allowed-tools. Datadog also stresses that model behaviour varies by version, and that a clean search is "only one piece of evidence". Treat a grep as a way to find lines to read, not as a verdict.

How the nine components scored, and what the scores mean

So, are Claude skills safe? In this sample, the answer depends on four or five specific lines per skill, not on the catalogue they come from. Three things stand out once the table is filled in:

• The risk is concentrated. Of the 49 business-marketing skills, 28 had zero hits for shell commands, network calls, hooks, MCP config, home-folder paths or key-related words in the first-pass regex scan. Plain instruction skills such as seo-audit are what most marketers install, and they rated Low.
• High means "data or instructions cross a boundary". The two High ratings went to the skill that pulls a remote instruction list and sends your contact details to outside sites, and the one that adds a remote MCP server holding your key. Neither has to be malicious to deserve a slow read.
• Agents need the same check. content-marketer combines Write and Edit with WebFetch and WebSearch (L4) and its description asks Claude to use it "PROACTIVELY". That earned Medium: scope its permissions before you let it touch a content folder.

The rubric is simple enough to reuse. Low: instructions only, or local scripts that read your input and nothing else. Medium: installs packages, needs credentials, writes outside the project, or pairs file-writing tools with web access. High: sends data to a third party, pulls remote instructions, or adds a remote MCP server. Low you can install after one read. Medium you install after reading the scripts and narrowing permissions. High you install only if you would have signed up for that vendor anyway.

Safer ways to install a skill once it passes

1. Copy, don't run an installer. Put the SKILL.md you read (plus any scripts you read) into .claude/skills/<name>/ or ~/.claude/skills/<name>/ by hand. Keep a note of the source commit.
2. Remove what you don't need. Delete the upsell paragraph, the remote fetch or the MCP block if the rest of the skill is useful without it. A skill is a text file; editing it is allowed.
3. Use the switches Anthropic documents. "disableSkillShellExecution": true stops ! commands in user, project, plugin and added-directory skills; teams can set it in managed settings so it can't be overridden. Organisations can also set allowManagedPermissionRulesOnly, which makes Claude Code ignore allowed-tools in project and personal skills.
4. Check repositories you clone, not just skills you download. Datadog's point is that a project's .claude/skills/, nested folders and directories added with --add-dir can all bring skills along. Before scripting claude -p over a repo you didn't write, read its .claude/ folder or turn hooks off for that run.
5. Keep keys in the environment. If a skill asks you to paste an API key into a project file, don't. Use environment variables, and keep .mcp.json out of commits if it holds anything secret.

How this checklist was put together

On October 18, 2026, Saazora made a shallow clone of davila7/claude-code-templates at commit 4df7973 into an isolated scratch folder and treated it as untrusted data. We read every file of eight marketing components and one hook by hand, recorded line numbers, and rated each one with the rubric above. A short regex script, kept outside the clone, pre-scanned all 49 business-marketing skills for shell, network, hook, MCP, home-folder and key-word patterns to pick the candidates; its hits are rough and were checked by hand. Nothing from the repository was installed, imported or run: no npx, pip, scripts or hooks. That means this page describes what the files say, not runtime behaviour. On October 20 the six quoted files were fetched again at commit ffcb267 and were byte-for-byte identical to 4df7973. Anthropic's documentation and Datadog's article were read on October 20, and copies are kept on file. Ratings are editorial. No vendor or author named here reviewed or paid for this article. More on how Saazora researches software.

Sources (checked October 20, 2026): davila7/claude-code-templates on GitHub, Anthropic: Agent Skills overview, Anthropic Engineering: Equipping agents with Agent Skills, Claude Code docs: Skills, Claude Code docs: Hooks, Claude Code docs: Security, Claude Code docs: MCP, Datadog Security Labs: Malicious coding agent skills and dynamic context.