skillhash

Is example-command safe?

Grade A, 94/100. No meaningful risk found.

An example user-invoked skill that demonstrates frontmatter options and the skills/<name>/SKILL.md layout

A

example-command

plugins/example-plugin/skills/example-command
94/100 · No meaningful risk found1 medium

An example user-invoked skill that demonstrates frontmatter options and the skills/<name>/SKILL.md layout

Content hash
sha256:50ecde9031c0f4994dc3be21330893bd5dd892801c7b5c3cadea356154c43d32
Files
1
Quality
100/100

Security findings

  • mediumUnrestricted shell accessSL601 · plugins/example-plugin/skills/example-command/SKILL.md:1
    Bash

    allowed-tools grants the skill any shell command without confirmation. Fix: Scope it, for example 'Bash(git status:*)' or 'Bash(npm test)'.

Files in this skill
  • SKILL.md1.2 KB

Questions about example-command

Is example-command safe to install?
Our scanner gave example-command grade A (94/100): no meaningful risk found. It matched 1 rule(s); review them below before installing. Static analysis cannot prove safety, so pin the reviewed revision with a lockfile.
How do I install example-command in Claude Code or Codex?
Run skillhash add github:anthropics/claude-plugins-official/plugins/example-plugin/skills/example-command. It downloads the exact commit, checks the grade against your policy, writes skills.lock and installs it into .claude/skills and .agents/skills.
What happens if example-command changes upstream?
Its content hash changes. skillhash verify fails in CI until you review the new version and update the lock. With a watch, you also get an alert.

More from anthropics/claude-plugins-official