We reviewed 289 popular agent skills. 72 ask for broad access.

Are Claude skills safe?

Mostly yes, if you read what you install. A Claude skill is a folder with a SKILL.md file and, often, scripts and reference documents. The agent follows those instructions with your permissions, so a skill can run shell commands, call APIs with your keys and edit files outside the project. None of the skills we kept in the catalog looked malicious; we left 5 repositories out of it after review, for reasons from offensive-security tooling to anti-bot evasion. But a quarter of the skills people actually install reach further than their description suggests, and in 13% of the skills we recommend, broad access is part of how they work. Safe use comes down to knowing which group a skill is in before you give it your shell.

The threat model: what a skill can do

Agent skills sit between the model and your machine, so their attack surface is everything the agent can touch. The risks that security researchers describe, and that we counted, fall into five groups:

• Prompt injection. Text in a SKILL.md, a reference file or content fetched at run time steers the agent. Prompt injection attacks are easiest when a skill loads instructions from a server; 24 skills in our sample do that.
• Data exfiltration and credential exfiltration. A skill can read environment variables and API keys and send them somewhere. We recorded 12 skills that upload your data by default and 4 that send keys or tokens to a third-party service.
• Remote code execution through installers. curl … | sh and unpinned packages download and execute code you never read (44 and 110 skills respectively), which is how a skill could execute arbitrary code after an upstream change.
• Supply chain attacks. Malicious skills published to open registries, look-alike names and compromised maintainers. This is the software supply chain problem the agent skills ecosystem inherited from npm and PyPI; Snyk confirmed 76 malicious payloads in one marketplace scan.
• Over-privileged execution. Pre-approved shell commands, hooks and disabled permission prompts turn one approval into standing access (36 skills pre-approve shell commands).

Skills are not the same layer as the Model Context Protocol. An MCP server exposes tools; a skill changes what the agent decides to do with them, which is why OWASP treats skill security as its own list rather than part of MCP or large language models in general.

How we reviewed the skills

The sample is the agent skills people use most, not a random draw from a marketplace: 201 repositories and 88 individual skills picked by installs on skills.sh, GitHub stars and search demand, with archived repositories and ones with inflated install counts left out. That makes this a study of the skills ecosystem as developers meet it, which is different from the marketplace-wide scans listed in the comparison below.

For every page we downloaded the skill folders, the plugin manifest and the hooks, read the source code of every script we had, and recorded facts, not impressions. Each fact names the file and line it comes from: where the skill sends data, which credentials or browser data it touches, what it pre-approves, what it installs, whether it loads instructions from a server, and what we could not read. A fixed rule then turns facts into one of three statuses:

• No issues found: we had every file in scope, read every script, and recorded nothing beyond running the skill's own local scripts.
• Check first: something worth knowing, such as network calls, an API key for the skill's own service, telemetry with an opt-out, a curl | sh installer, code outside the repository, or a partial review of a large pack.
• Broad access: at least one of the ten broad flags listed in the chart below.

The reviews are written by AI reviewers working from the files under a fixed rubric; the status is computed by code from the recorded facts, so the same facts always give the same status. Every skill was also scanned with NVIDIA SkillSpector in static mode, and its hits were used as leads rather than verdicts. The full rules are on the methodology page and the security page.

Limitations. 47 of 289 reviews (16%) cover every file; the rest are partial, mostly because a repository is too large to download in full or because the skill depends on a package or CLI outside it. Each review page says what was not covered. Static review does not observe a skill running, so behaviour that only appears at run time can be missed.

What the 289 skills reach on your machine

The biggest group is not dangerous, just connected. 74% of the skills rely on an outside CLI or package we could not review, 64% make network requests, and 49% install packages. 66% of the skills can send something off your machine in some form, from an API call with your key to telemetry.

Inside the broad-access group the picture is narrower. Pre-approved shell commands lead: the skill's frontmatter or settings let the agent run broad commands without asking each time. Next come skills that load instructions from a server at run time, so what the agent does can change after you install it. Fewer skills upload data by default, turn off permission prompts, use the browser session or push to git on their own.

Skills with scripts carry more risk

Of 124 repositories that ship executable scripts, 49 (40%) need broad access. Of 77 instruction-only repositories, 16 (21%) do. That is a 1.9× difference, close to the 2.12× odds ratio that Liu et al. found across 31,132 marketplace skills. Instruction-only skills are not risk-free: a SKILL.md can still tell the agent to download and execute code or to fetch remote instructions. But scripts are where code execution, credential handling and installers live, so they deserve the first look.

Popular skills are not safer

Install counts measure attention, not safety. The 50 most installed skills in the sample (median 1,216,385 installs) ask for broad access in 20% of cases, close to the 26% of the rest, and 26% of them have no issues. Large vendor packs often depend on their own CLIs and cloud APIs, which is reasonable, but it means "everyone uses it" tells you nothing about what it does on your machine.

Mapped to the OWASP Agentic Skills Top 10

The OWASP Agentic Skills Top 10 (AST10, version 1.0-2026) is the first comprehensive security framework written for agent skills. Our recorded facts map onto five of its risks:

AST02 is near-universal because skills are glue: they wrap CLIs, SDKs and package managers. That is a supply chain question more than a malware question. Pin versions and know which packages a skill pulls in. AST03 is the one to act on, because over-privileged skills turn a single approval into standing permission.

Real examples from the files

These are the most installed skills in the broad-access group, with the file and line behind the finding. In each case the behaviour is documented and part of what the skill does; it is a design choice you should know about, not malware.

• HyperFrames · 15,667,343 installs Uploads your data by default skills/hyperframes-cli/references/feedback.md:3
• Azure Skills Plugin · 14,328,417 installs Pre-approves broad shell commands .github/plugins/azure-skills/skills/microsoft-foundry/project/create/create-foundry-project.md:7
• Caveman · 4,383,323 installs Sends your keys or tokens to a third-party service skills/caveman-setup/SKILL.md:70
• Vercel Agent Skills · 3,041,096 installs Loads instructions from a server at run time skills/web-design-guidelines/SKILL.md:26
• Impeccable · 1,470,412 installs Loads instructions from a server at run time .claude/skills/impeccable/reference/new-work.md:52
• hyperframes-cli · 1,306,005 installs Uploads your data by default skills/hyperframes-cli/references/feedback.md:3

Why a scanner verdict is not enough

SkillSpector's own recommendation was "do not install" for 195 of 288 skills (68%). Pattern matching flags any skill whose instructions mention git push, rm -rf or an environment variable, including skills that tell the agent not to do those things. When we read the files, 64 of those 195 ended up as broad access, 126 as check first and 5 as clean. Scanners are good at finding leads and bad at telling malicious behavior from a warning about it. Use them to decide what to read, not whether to install.

Skills change after you check them

Our monitor compares each repository's skill files with the version we reviewed every day. 22 of 201 repositories (11%) changed skill folders, plugin manifests or hooks within days of the review. Most changes are ordinary updates, but an update is exactly how a trusted skill can start doing something new, which OWASP calls update drift. Our pages say when files changed after the review, and the review is redone once the changes settle.

How this compares with other studies

The headline numbers measure different things, so compare them with care. Marketplace scans count everything uploaded, including abandoned and malicious entries; we looked only at skills people install most and counted documented access rather than vulnerabilities. The shared finding is the same: executable code and remote content are where the risk is, and supply chain security matters more than hunting for malicious code in instructions.

How to check a skill before you install it

For developers and security teams alike, eight checks catch most of the security risks above:

1. Read the frontmatter. Look for pre-approved tools (allowed-tools with broad Bash), hooks and anything that changes your agent's settings.
2. Open the scripts folder. Note what each script runs, what it downloads and whether it sends anything over the network.
3. Search for installers. curl … | sh, npx -y and unpinned pip install run code you have not seen.
4. Find remote instructions. A skill that fetches a URL and follows what it says can change after you check it.
5. Check where your keys go. An API key for the skill's own service is normal; sending keys or tokens to a third party is not.
6. Pin what you reviewed to a commit or tag, and look again after updates.
7. Run broad-access skills in a sandbox first: a container or a separate project without production credentials.
8. Treat scanner verdicts as leads. Use our review page or the file itself to confirm.

Get the data

The full dataset has one row per reviewed skill: security status, review coverage, files in scope, recorded flags, our verdict, depth, installs, stars, the raw scanner recommendation and the date of the check. It is published under CC BY 4.0; please link to this page when you use it.

skills-security-2026.csv

Cite as: SkillCritic, "We reviewed 289 popular agent skills. 72 ask for broad access", Oct 29, 2026, https://skillcritic.com/research/skills-security-2026/