Agent skills marketplaces › Are agent skills safe?
Are agent skills safe? How to check a skill before you install it
Not by default. A skill is instructions your agent follows and, often, scripts it runs with your user permissions, and 2026 audits found flaws in over a third of public skills. Before installing, check who publishes it, what its SKILL.md tells the agent, every script and download, any tool grants or hooks, and pin the version you read. Marketplace scans help; they don't replace reading.
What a skill can do on your machine
- Run code. A skill's
scripts/folder is code the agent runs when the instructions say so. Anthropic's docs say a plugin "can execute arbitrary code on your machine with your user privileges", and hooks and MCP servers in a plugin run outside Claude Code's sandbox. - Steer the agent. The SKILL.md enters the conversation as instructions and, in Claude Code, stays there for the rest of the session.
- Pre-approve tools. Claude Code's
allowed-toolsfield lets listed tools run without asking during the turn that invokes the skill. - Run commands before the model reads it. A line like
!`git diff HEAD`in a Claude Code skill runs the command and pastes its output in first. - Outlast its turn. A
hooksfield registers hooks that keep running for the rest of the session. - Change after you read it. Auto-update can replace the files you reviewed.
What the 2026 audits found
| Study | Sample | Finding |
|---|---|---|
| Snyk ToxicSkills, Feb 5 | 3,984 skills from ClawHub and skills.sh | 534 (13.4%) with a critical issue; 1,467 (36.82%) with at least one flaw; 76 malicious payloads confirmed by hand |
| Koi Security, Feb 2 | All 2,857 skills on ClawHub | 341 malicious; 335 used fake prerequisites to install Atomic Stealer on macOS |
The common flaws weren't exotic: hardcoded API keys, careless credential handling, instructions that pull in untrusted content. Most of Koi's 341 hid in setup steps a person was asked to run; Snyk's 76 confirmed payloads sat in the skills' markdown instructions to the agent.
The ten-point check
| # | Check | What fine looks like | Red flag |
|---|---|---|---|
| 1 | Publisher | The vendor's own org (microsoft/playwright-cli for Playwright) or a known author with a history | A new account with dozens of near-identical skills |
| 2 | Source and version | A public repo you can read; you install a specific commit | A download link with no source, or "always latest" |
| 3 | Frontmatter | name and description match what the body does | allowed-tools wider than the job (Bash(*)), or a hooks field you didn't expect |
| 4 | Instructions | Steps for the task, in plain sight | Reading ~/.ssh, .env or keychains; posting data to a URL; "don't mention this to the user"; text hidden in HTML comments |
| 5 | Scripts | Short, readable, doing what the SKILL.md says | Network calls the task doesn't need; eval, base64 blobs, minified code |
| 6 | Prerequisites | Packages from a registry you know | curl … | bash, or a binary from a paste site: the ClawHavoc pattern |
| 7 | Inline commands | Read-only commands such as git diff | !`…` lines that write files or reach the network |
| 8 | Plugin extras | No hooks or MCP servers, or ones you can explain | Anything in hooks/hooks.json, .mcp.json or bin/ you can't account for |
| 9 | Scanner results | Clean on more than one scanner | Scanners disagree: read that part closely |
| 10 | Scope | Installed for one project, reviewed in a pull request | Installed globally with auto-update on |
A worked review: Anthropic's webapp-testing skill
anthropics/skills/skills/webapp-testing on November 13: a SKILL.md, a license, three example Python files and one helper script.
- Publisher and source (1, 2): Anthropic's public repo. Pass.
- Frontmatter (3):
name,descriptionandlicenseonly; no tool grants or hooks. Pass. - Instructions (4): the body says to run
scripts/with_server.py --helpfirst and "DO NOT read the source until you try running the script first", treating the scripts as black boxes to save context. That's a sensible design, and it is also the reason you read the script yourself: the agent has been told not to. - Script (5):
with_server.pyis 3,693 bytes. It starts the servers you name withsubprocess.Popen(..., shell=True), waits for their ports onlocalhost, then runs your command. It runs whatever command it's given, which is its job; it makes no other network calls. Pass, knowing that it executes what the agent passes it.
What each marketplace checks
| Source | Check | What happens on a bad result |
|---|---|---|
| Anthropic's directory | Automated validation and a security scan of every version; a person reviews each new listing | A new listing doesn't go live until review passes. Third-party marketplaces get no Anthropic review |
| ClawHub | ClawScan: independent scanners plus an AI judge, before listing and again later | Malicious blocked from download; Suspicious shown with a warning |
| skills.sh | Gen Agent Trust Hub, Socket and Snyk, routine audits | Results shown on the skill's page; "cannot guarantee" |
| Skills Directory | Static analysis, 120 detection patterns, letter grade | Grade shown; Pro alerts if a saved skill's grade drops |
| Tessl | Snyk security scoring, best-practice review, evals | Findings shown; Enterprise can block installs by policy |
| Agensi | An 8-point scan of every version; creators verified | A skill goes live only after its scan; paid skills carry a money-back guarantee |
GitHub (gh skill) | None: "Skills are not verified by GitHub" | Use gh skill preview to read before installing |
| SkillsMP | None described | You check the source repo |
Scanners you can run yourself
- NVIDIA SkillSpector (Apache 2.0), the scanner inside ClawHub's ClawScan:
uv tool install git+https://github.com/NVIDIA/skillspector.git, thenskillspector scan ./my-skill/. It reads folders, repos, URLs and zip files, and runs without a model (--no-llm) or with one. - Cisco skill-scanner:
pipx install cisco-ai-skill-scanner, thenskill-scanner scan ./skill, with an optional model judge and a pre-commit hook. Its README is candid: "No findings ≠ no risk."
Run one on a skill before you commit it, or in CI on every change to .agents/skills/ or .claude/skills/.
For Claude Code plugins, claude --plugin-dir <dir> plugin details <name> lists every skill, hook and server a cloned plugin contains before you install it. Where to find skills worth checking is in the marketplace comparison; ClawHub's own history is in ClawHub skills; team-wide rules are in Sharing skills across a team.
Fewer skills is also safer. A skill nobody runs is risk with no benefit, and in Claude Code it still costs context on every turn. Zest, made by the company that publishes this site, shows which installed skills each engineer's sessions actually load, so a team can remove the rest; it doesn't scan skills. Zest for skills
Questions
Can an agent skill contain malware?
Yes. A skill can bundle scripts the agent runs with your user permissions, and its instructions can tell the agent to fetch and run more. In February 2026 Koi Security found 341 malicious skills on ClawHub, most of them installing a macOS info-stealer through fake setup steps.
How do I scan a skill before installing it?
Read it first: the SKILL.md, every script and any hooks or MCP config. Then compare what scanners say: skills.sh shows Gen Agent Trust Hub, Socket and Snyk results per skill, Skills Directory gives a letter grade, Tessl shows Snyk findings, and ClawHub publishes a ClawScan verdict. gh skill preview shows a skill's files in your terminal without installing it.
Are skills from Anthropic's or OpenAI's marketplaces safe?
Safer, not guaranteed. Anthropic scans every version submitted to its directory and has a person review new listings, but its own docs tell you to review any plugin before installing, whichever marketplace it comes from. Anthropic doesn't review third-party marketplaces at all.
Is a skill without scripts safe?
Safer, but instructions alone can do harm: a SKILL.md can tell the agent to read secrets, send data to a URL or run a download. In Claude Code, a skill's frontmatter can also pre-approve tools for its turn and register hooks that run for the rest of the session.
Should I install skills globally or per project?
Per project when you can. A project skill lives in the repository, gets reviewed in pull requests like code, and only loads where it applies. Install globally only skills you've read and use everywhere.