How to check an agent skill before you install it.
Read every file in a skill before installing it. Skills can bundle executable scripts, not only instructions. Those scripts can run with your full user privileges.
Confirm who publishes the skill. Read what every file does. Note which tools it pre-approves. Trace where it sends data.
Then install the exact commit you reviewed. Treat scanner verdicts as signals, not proof.
The short version
Treat a skill like software you install. Read it before it runs.
What an agent skill can do on your machine.
An agent skill is a folder with SKILL.md. SKILL.md holds YAML frontmatter and Markdown instructions. Optional folders hold scripts, references, and assets.
Agents load skill names and descriptions at startup. They load the full instructions when the skill activates. Bundled files load only when needed.
Descriptions therefore reach your agent before you invoke anything. Read them as carefully as the scripts.
Claude Code skills have full network access. Bundled helper scripts run with full user privileges. Anthropic says to treat skills like installed software.
SourcesAgent Skills specificationBuild skillsAgent Skills overview: security considerations"Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild
What 2026 research found in public skill registries.
Snyk scanned 3,984 skills from ClawHub and skills.sh. The scan reflects February 5, 2026. 534 skills, or 13.4%, had a critical issue.
Snyk found flaws of any severity in 1,467 skills. That was 36.82% of its sample. Its human review confirmed 76 malicious payloads.
A USENIX Security 2026 paper analyzed 98,380 skills. The skills came from two major registries. It confirmed malicious behavior in 157 skills. One actor using brand impersonation accounted for over half.
A May 2026 preprint used controlled tests, not live registries. Its selection test had four models choose between paired skills. Adversarial descriptions won 77.6% of paired trials on average. Its vetting test replicated a ClawHub-style pipeline locally. Evasive wording avoided blocks in 36.5–100% of cases.
Each study uses its own sample and method. Never add their numbers together. Snyk's page title states different counts than its body. We cite the body text.
SourcesSnyk ToxicSkills study of agent skills"Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the WildUnder the Hood of SKILL.md: Semantic Supply-chain Attacks on AI Agent Skill Registry
Run this ten-step review before you install a skill.
The review below fits one skill or a whole repository. It runs from source checks to a pinned install. Each step maps to OWASP's skills checklist.
Review the files outside your agent. A terminal and plain editor are enough. Let your agent see the repository only afterward.
- 01
Confirm the publisher and the name.
Open the source repository, not only the listing. Check the owner and spelling. Over half of one study's confirmed cases impersonated brands.
- 02
List what the installer would add.
Run the add command with the list flag. It shows skills without installing them.
- 03
Read every file, not only SKILL.md.
Read scripts, references, assets, and config files. Anthropic says to review all bundled files.
- 04
Check what the frontmatter grants.
Look for allowed-tools and hooks. Ask why each grant is needed.
- 05
Find commands that run without a prompt.
Search SKILL.md for exclamation-backtick commands. Claude Code runs them while rendering the skill.
- 06
Trace every network call and link.
List each URL the skill fetches or opens. Fetched content can carry malicious instructions.
- 07
Check where secrets could go.
Flag reads of keys, credentials, environment files, or wallets. Compare each read with the stated job.
- 08
Read audit verdicts as signals.
Check the skill's page on skills.sh. A pass is one input, not proof.
- 09
Pin the commit you reviewed.
Record the full commit hash. Install from that reviewed copy.
- 10
Review again before every update.
An update is new code. Review the upstream changes first.
SourcesSkill Security Assessment Checklistskills CLI referenceAgent Skills overview: security considerationsExtend Claude with skillsskills.sh security audits"Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild
Map each check to the OWASP Agentic Skills Top 10.
OWASP's Agentic Skills Top 10 names ten skill risks. OWASP lists it as an Incubator project. Its latest version is labeled 1.0-2026.
The table turns each risk into a pre-install question. The checks paraphrase OWASP's assessment checklist.
| Factor | What to check | Where to look |
|---|---|---|
| AST01 Malicious skills | Publisher identity, lookalike names, encoded payloads, curl calls to unknown hosts | Repository owner, SKILL.md, and the scripts folder |
| AST02 Supply chain compromise | Dependencies locked without version ranges; repo config treated as code | package.json, requirements.txt, .claude/settings.json |
| AST03 Over-privileged skills | Tools, paths, and secret reads beyond the stated job | allowed-tools, hooks, reads of ~/.ssh, ~/.aws, or .env |
| AST04 Insecure metadata | Description matches behavior; no hidden Unicode or base64 text | name, description, and every frontmatter field |
| AST05 Untrusted external instructions | Every fetched URL, followed to what it links; inline what you can | Links in SKILL.md, references, and scripts |
| AST06 Weak isolation | Where the skill runs and what it can reach | Agent sandbox, container, and network settings |
| AST07 Update drift | An immutable pin and a fresh approval for each update | Recorded commit hash and npx skills check output |
| AST08 Poor scanning | More than one scanner; no single verdict used as the gate | skills.sh audits plus your own secret and code scans |
| AST09 No governance | Inventory, approval record, review cadence, and removal path | npx skills list output and your team register |
| AST10 Cross-platform reuse | Behavior checked in each agent, not assumed equal | Each agent's skill docs and permission model |
OWASP AST01 to AST10 as pre-install checks. Wording paraphrases the OWASP Skill Security Assessment Checklist.
SourcesSkill Security Assessment Checklist"Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the WildExtend Claude with skillsUnder the Hood of SKILL.md: Semantic Supply-chain Attacks on AI Agent Skill RegistryAgent Skills overview: security considerationsskills CLI referenceskills.sh security auditsBuild skills
SourcesOWASP Agentic Skills Top 10
Read the frontmatter like a permission request.
The Agent Skills spec requires only name and description. Optional fields include license, compatibility, metadata, and allowed-tools. The spec marks allowed-tools experimental, and support varies.
Claude Code treats allowed-tools as a pre-approval. Listed tools run without prompts during the invoking turn. Workspace trust does not gate the field.
Anthropic warns that a skill can grant itself broad access. Review repository skills before running Claude Code there.
Claude Code skills can also declare hooks. Those hooks register on invocation and persist for the session. Codex reads an optional agents/openai.yaml file. It can set invocation policy and MCP dependencies.
---
name: commit
description: Stage and commit the current changes
disable-model-invocation: true
allowed-tools: Bash(git add *) Bash(git commit *) Bash(git status *)
---SourcesAgent Skills specificationExtend Claude with skillsBuild skills
Find code that runs before the agent reads the skill.
Claude Code supports dynamic context in skills. An exclamation mark before backticks runs a shell command. The output replaces the placeholder before Claude sees it.
Fenced blocks marked the same way also run. These commands do not prompt while the skill renders.
Your permission rules still apply to them. A deny rule aborts the invocation. A skill's own allowed-tools can pre-approve them. Deny and ask rules still override that grant. Outside auto mode, unapproved commands abort the skill.
Teams can turn this off with disableSkillShellExecution. Bundled and managed skills are not affected.
Also check for a plugin manifest folder inside the skill. Claude Code can load such a folder as a plugin. Plugins can add agents, hooks, and MCP servers. Project folders need workspace trust first.
SourcesExtend Claude with skills
Review a skill from a clone, then install that copy.
A clone gives you a fixed copy to read. Record its commit hash before you read anything. That hash is your pin.
Keep the clone outside your project. Do not open it with your agent first. Claude Code applies project allowed-tools without workspace trust.
The skills CLI documents installs from a local path. That route installs the files you reviewed. Run the list flag first to see what it finds.
Replace claude-code with your agent's name. The CLI reference lists supported agents.
The CLI reference does not document commit pins for add. Version 1.7.4 source reads a #ref suffix. That suffix can name a full commit hash. Treat it as undocumented behavior.
# 1. Review outside your project. Do not open the clone with your agent.
mkdir -p ~/skill-reviews && cd ~/skill-reviews
git clone https://github.com/OWNER/REPO.git
cd REPO
git rev-parse HEAD # record this commit hash
git ls-files # every file, not only SKILL.md
git grep -nE 'curl|wget|https?://|base64|eval|exec'
git grep -nE '\.ssh|\.aws|\.env|credential|wallet'
git grep -nE '^(allowed-tools|hooks|shell):' -- '*SKILL.md'
git grep -nF '!`' -- '*SKILL.md'
git grep -n '^```!' -- '*SKILL.md'
git ls-files | grep -E '\.claude-plugin/|agents/openai\.yaml'
# 2. From your project, install the copy you reviewed.
cd ~/code/your-project
npx skills add ~/skill-reviews/REPO --list
npx skills add ~/skill-reviews/REPO --skill SKILL_NAME -a claude-codeSourcesskills CLI referenceskills CLI v1.7.4 source codeExtend Claude with skillsSkill Security Assessment Checklist
Treat audit verdicts as signals, not approval.
skills.sh combines audits from three partners. They are Gen Agent Trust Hub, Socket, and Snyk. Its docs say it cannot guarantee every listed skill. They ask users to review skills before installing.
Verdicts disagreed on November 1, 2026. The find-skills row read Safe, 0 alerts, Med Risk. Some rows showed Pending for every auditor.
The CLI requests audits only for confirmed-public GitHub repositories. Disabling telemetry also turns those requests off. Check the skills.sh page before cloning.
A scanner pass is one signal. OWASP recommends several tools, not one gate. Never rely on a scanner that is itself a skill.
Sourcesskills.sh security auditsskills.sh documentationskills CLI troubleshooting and telemetrySkill Security Assessment ChecklistUnder the Hood of SKILL.md: Semantic Supply-chain Attacks on AI Agent Skill Registry
Where skills live, and how to turn one off.
Each agent loads skills from its own folders. The table lists documented locations and off switches. Check your agent's docs for newer options.
The skills CLI lists installs with npx skills list. Its check command reports available updates. It exits with code 1 when updates exist. That lets it gate a CI job.
Treat each update as new code. Review the upstream changes before running npx skills update. Remove a skill with npx skills remove and its name.
Codex can disable a skill without deleting it. Add a skills.config entry with enabled set to false. Then restart Codex.
| Factor | skills CLI | Claude Code | Codex |
|---|---|---|---|
| Project skills | ./<agent>/skills/ by default; commit it to share | .claude/skills/<skill-name>/SKILL.md | .agents/skills, from the working folder up to the repo root |
| Personal skills | ~/<agent>/skills/ with the -g flag | ~/.claude/skills/<skill-name>/SKILL.md | $HOME/.agents/skills |
| See what is installed | npx skills list | The /skills menu | /skills, or type $ to mention a skill |
| Stop automatic use | Set in the agent, not the CLI | disable-model-invocation: true in frontmatter | allow_implicit_invocation: false in agents/openai.yaml |
| Turn a skill off | npx skills remove <skill-name> | Delete the skill folder, or deny Skill(name) | [[skills.config]] entry with enabled = false |
Documented skill locations and controls, checked November 1, 2026.
Sourcesskills CLI referenceExtend Claude with skillsBuild skills
Set team rules before anyone installs skills.
OWASP's checklist asks for a central skill inventory. Each entry records name, version, hash, installer, and scan status. It also asks for approval records and a review cadence.
Claude Code rules can allow or deny skills by name. Denying the Skill tool disables all skills.
Managed settings can make Claude Code ignore skill allowed-tools. That uses allowManagedPermissionRulesOnly in version 2.1.282 or later.
Commit reviewed project skills to the repository. Everyone then loads the same reviewed files. Pair that with a pull request review for each change.
- Keep one register of approved skills and commits.
- Require a named approver for each new skill.
- Re-review every update before it ships.
- Remove skills when owners leave or incidents occur.
- Run unreviewed skills only in a sandbox.
SourcesSkill Security Assessment ChecklistExtend Claude with skillsskills CLI reference
How a skill review differs from an MCP server review.
OWASP frames the split this way. MCP is how the model talks to tools. Its skills list covers what those tools actually do.
MCP server reviews center on a program the agent calls. A skill review adds text the agent loads and follows. Descriptions, instructions, and scripts all need reading.
The two overlap. A skill can ship a plugin with MCP servers. Codex skills can declare MCP dependencies. Review those servers with an MCP checklist too.
SourcesOWASP Agentic Skills Top 10Extend Claude with skillsBuild skills
Where Legba fits, and where it does not.
Legba publishes this guide. Legba's agent skill installs through the same skills CLI. Apply this routine to it before installing.
Legba's skill repository contains SKILL.md and its scripts. Clone it and review that copy before you install. Install the reviewed clone with this guide's local-path commands.
Legba's skill had no skills.sh audit listing. We checked on November 1, 2026.
Legba provides routing and isolated browser sessions for agents. Neither feature reviews skill code. A skill's scripts still run where your agent runs.
SourcesInstall the Legba skillskills.sh security auditsskills CLI reference
FAQs.
Is skills.sh safe to install from?
Can the skills CLI pin a commit?
Does a scanner pass mean a skill is safe?
Should I read only SKILL.md?
What does allowed-tools do in Claude Code?
How do I remove an installed skill?
Does Legba review skills for me?
References
- 01Agent Skills specificationAgent Skills open standard
- 02OWASP Agentic Skills Top 10OWASP Foundation
- 03Skill Security Assessment ChecklistOWASP Agentic Skills Top 10 project
- 04skills CLI referenceVercel Labs
- 05skills CLI troubleshooting and telemetryVercel Labs
- 06skills CLI v1.7.4 source codeVercel Labs
- 07
- 08skills.sh documentationVercel
- 09Extend Claude with skillsAnthropic
- 10
- 11Build skillsOpenAI
- 12
- 13"Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the WildUSENIX Security 2026 paper on arXiv
- 14Under the Hood of SKILL.md: Semantic Supply-chain Attacks on AI Agent Skill RegistryarXiv preprint, May 2026
- 15