Are Claude Code skills safe? How to check one before you install it

Agent skills are folders with a SKILL.md file and, often, scripts. Claude Code, Codex, Cursor and Gemini CLI load them into the agent's context when the description matches your request. That makes them useful. It also means a skill you copied from a stranger's repo can tell your agent what to run, with your shell, your files and your credentials.

Most skills are fine. A few are not, and the ones that are not rarely look malicious at first glance.

What can go wrong

• Prompt injection in plain sight. Lines such as “ignore previous instructions” or “do not tell the user” turn guidance into a hijack.
• Hidden text. HTML comments do not render on GitHub, and Unicode tag characters do not render anywhere, but the agent reads both.
• Credential access. A helper script that reads ~/.ssh/id_rsa, ~/.aws/credentials or dumps every environment variable.
• Exfiltration. The same script posting data to a webhook catcher or a paste site.
• Remote code. curl ... | bash installs, where whoever controls the URL controls your machine.
• Permission bypass. allowed-tools: Bash with no scope, or flags that turn off approval prompts.
• Drift. The skill was fine when you reviewed it. A later commit changed it, and nobody noticed. OWASP lists this as AST07, update drift, in its Agentic Skills Top 10.

A one-minute check

1. Open SKILL.md raw, not rendered, so HTML comments are visible.
2. Read every script the skill ships. Search for curl, wget, .ssh, .env, environ, eval, base64.
3. Check allowed-tools in the frontmatter. Scoped entries like Bash(git status:*) are good; a bare Bash is not.
4. Pin the commit you reviewed. Installing from main means installing whatever main is tomorrow.

Or paste the GitHub link into the Skillhash scanner. It runs 30 rules covering the list above, shows the exact line for every finding, and gives the skill a grade from A to F. Reports are shareable and every public skill we have seen is in the directory.

What a scan cannot tell you

Static rules catch known patterns. They do not prove a skill is safe, and researchers have shown that a determined attacker can get past any single scanner. The defence that does not depend on catching everything is pinning: lock the exact content you reviewed, and fail the build when it changes.

uv tool install skillhash
skillhash init
skillhash add github:owner/repo/skills/the-skill
skillhash verify   # in CI: exits 1 on any change