Skill safety

Are Claude Code and agent skills safe?

Not by default. An agent skill is a folder of instructions, and often scripts, that your agent loads and follows with your permissions, so a skill from a stranger deserves the same care as any code from a stranger. Of the 139,726 public skills Skillspace has scanned, 129,519 (92.7%) passed our static safety scan with no flag, and 10,207 (7.3%) were flagged for review, rated risky or unsafe, or flagged by our model. 27,503 met our launch-quality bar. A pass is not a guarantee: read the source before you install anything.

Published 6 November 2026. Ratings from the 24 September 2026 snapshot.

What our scan of public skills found

Counted over the 139,726 skills in the 24 September 2026 snapshot. A skill our model flagged is counted once, under its flag, never as passed.

Our labelling and judging models also flagged 6 for prompt injection, 5 for guardrail bypass, 3 for harmful content, 1 for credential exposure, 102 for attack benchmarks, 200 for test fixtures. A flag overrides a passing scan: the skill is never launch-quality and never recommended.

What other audits found

Snyk's ToxicSkills audit, published 5 February 2026, scanned 3,984 skills from ClawHub and skills.sh. It reports that 36.82% had at least one security issue, 13.4% had a critical one, and 76 carried confirmed malicious payloads. Read Snyk's report.

How to check a skill before you install it

1. Open the skill's source on GitHub and read the whole SKILL.md, not just its description.
2. Read every script it ships. A static scan of the SKILL.md cannot see what a bundled script does.
3. Search for a remote script piped into a shell (curl … | sh), deletes rooted at ~ or /, eval or exec, and base64 decoding.
4. Look for reads of ~/.ssh, /etc/passwd or credential variables such as GITHUB_TOKEN, and for webhook or paste URLs it could send data to.
5. Look for text telling the agent to ignore earlier instructions or not to tell you what it does.
6. Check who publishes it, and prefer a skill with a licence and a version you can pin.
7. Look the skill up on Skillspace: its page shows the grade, the safety verdict and any flag.

The seventeen rules our scanner checks

• Critical (score capped at 15, verdict unsafe): destructive rm -rf on home/root; fork bomb; pipe remote script to shell; reverse shell.
• High (score capped at 45, verdict risky): prompt-injection: ignore-previous; exfiltration language; instructs to hide actions from user; references sensitive credential env; accesses sensitive system files; executes shell/subprocess; dynamic code execution (eval/exec); base64 decode (possible obfuscation).
• Medium (score capped at 72, verdict review): reads environment variables; suspicious outbound endpoint; hidden/zero-width/bidi unicode chars.
• Low (4 points off, verdict stays ok): over-broad allowed-tools ('*'); mentions secrets in text.

The full rules, weights and caps are on the methodology page. To let your agent check ratings itself, connect the Skillspace MCP server.

Frequently asked questions

Are Claude Code skills safe?

Not by default. An agent skill is a folder of instructions, and often scripts, that your agent loads and follows with your permissions, so a skill from a stranger deserves the same care as any code from a stranger. Of the 139,726 public skills Skillspace has scanned, 129,519 (92.7%) passed our static safety scan with no flag, and 10,207 (7.3%) were flagged for review, rated risky or unsafe, or flagged by our model. 27,503 met our launch-quality bar. A pass is not a guarantee: read the source before you install anything.

How do I know if a skill from GitHub is safe?

Read the SKILL.md and every file it ships before you install it. Look for commands that pipe a downloaded script into a shell, deletes rooted at your home folder, reads of ~/.ssh or credential variables such as GITHUB_TOKEN, eval or exec calls, base64 decoding, and any text telling the agent to ignore earlier instructions or hide what it does from you. Skillspace's scan checks for those patterns in every public skill it indexes, and each skill's page shows the verdict.

What does Skillspace's safety scan check?

Seventeen static rules in four severity classes. A critical match, such as a reverse shell or a remote script piped into a shell, caps the score at 15 and rates the skill unsafe; a high match, such as prompt-injection text, exfiltration language or reading credential variables, caps it at 45 and rates it risky; a medium match caps it at 72 and flags it for review. The scanner never runs the code it reads.

Does a passed scan mean a skill is safe?

No. A static scan sees patterns in text, not what a skill does when it runs, and the Skillspace scan reads the SKILL.md, not every script a skill ships. A pass means no known risky pattern matched. Read the source, and install skills only from authors you trust.