Are Claude Skills Safe? A Practical Risk Framework

The 26% Problem: Why Skills Are Riskier Than They Look

If you've installed an agent skill because the description sounded useful, there's roughly a one-in-four chance you picked up a vulnerability along with it. The largest empirical study of the ecosystem to date analyzed over 31,000 skills and found that 26.1% contain at least one vulnerability, with 13.3% exhibiting data exfiltration patterns and 5.2% showing high-severity patterns strongly suggesting malicious intent.

These aren't just theoretical numbers. In December 2025, a modified GIF-creation skill silently delivered MedusaLocker ransomware to users who thought they were generating images. Weeks later, the ClawHavoc campaign flooded a major registry with 341 malicious skills in three days — all connected to a single command-and-control server, some writing backdoors into agent memory files so they survived even after the skill was removed.

The structural weakness behind these attacks is what researchers call the consent gap. Once you approve a skill, it gains persistent permissions — reading and writing files, downloading code, opening network connections — without further prompts. There's no cryptographic signing, no mandatory registry security review, and no standard inspection tooling. A skill simply inherits everything its host agent already has.

That inheritance is what makes a compromised skill more dangerous than a compromised npm package. As Mondoo's analysis puts it: a compromised npm package runs code, but a compromised skill runs code inside an AI agent that already holds your credentials and your environment. The blast radius includes your filesystem, your API keys, and any system the agent can reach.

The problem compounds because skills don't look dangerous:

• Malicious instructions hide in invisible Unicode characters and HTML comments, evading traditional malware scanners
• Skills can be updated after installation, so an upgrade can introduce malicious code
• Static analysis misses time-delayed payloads and environment-gated triggers
• In most environments, you simply don't know what skills are active across your team

Script-bearing skills are 2.12 times more likely to be vulnerable than instruction-only skills, which is why SkillzBench is launching with instruction-only skills and listing script-bearing ones link-out only. But even "clean" code can hide behavioral compromise — HiddenLayer researchers note that auditing only for malicious code misses skills that are technically clean yet behaviourally compromised.

Vendors have largely deferred responsibility to users, saying people should only install trusted skills. That's reasonable advice only if users can actually verify what a skill does before running it. Most can't — which is exactly the gap SkillzBench is building to close, with version pinning, security scanning, and sandboxed benchmarking designed to make skill risk visible before installation.

Five Gaps the Ecosystem Doesn't Cover (And How to Close Them Yourself)

The scariest part of the skills ecosystem isn't what attackers do — it's what the infrastructure never bothered to build. Independent security analysis has mapped five structural gaps that leave every skill installation exposed, and none of them close on their own.

First, there's no version pinning. Skills can be updated after installation, and as Red Hat notes, an upgrade "can include malicious code or vulnerabilities." The skill you audited last month may not be the skill running today. Second, there's no standard inspection tooling — official guidance amounts to "read the files manually," which reliably misses hidden instructions. Third, no registry enforces mandatory security review; anyone with a GitHub account can publish.

Fourth, behavioral verification remains immature. Static analysis catches malicious code but misses what HiddenLayer calls skills that are "technically clean but behaviourally compromised" — including invisible Unicode payloads and time-delayed triggers. Fifth, and perhaps most dangerous for teams: no organizational visibility. As Mondoo puts it, "In most environments today, you simply don't know what skills are active across your team."

The research on why current defenses fail is sobering. A meta-analysis of 78 studies found attack success rates exceed 85% against state-of-the-art mitigations under adaptive attacks, with most defenses achieving less than 50% mitigation. Static scanning alone can't see invisible Unicode or environment-gated payloads — the exact techniques found in a popular code-review skill with 312 GitHub stars that secretly auto-approved "security-exempt" PRs.

The consensus mitigation framework across academic, Mondoo, and HiddenLayer sources is straightforward:

• Treat skills as third-party code, not settings — and prefer instruction-only skills, which are 2.12× less likely to be vulnerable than script-bearing ones
• Pin every version to a specific commit and track upstream changes
• Apply least privilege: sandbox execution, restrict network and filesystem access
• Audit what's installed — maintain an organizational inventory of active skills

This is the same framework SkillzBench is being around: pinning each skill version to a commit SHA, scanning and re-scanning on upstream changes, and benchmarking in sandboxes so behavior gets verified, not just code. Until the ecosystem builds these controls natively, the burden sits with you — and the empirical research showing 26.1% of skills carry at least one vulnerability makes clear that burden is real.

A Five-Step Risk Framework You Can Apply Today

Knowing that roughly a quarter of skills carry at least one vulnerability is one thing. Knowing what to do about it on Monday morning is another — so here are five steps that translate the research into practice.

Step 1: Prefer instruction-only skills. The largest empirical study to date found that script-bundling skills are 2.12× more likely to contain vulnerabilities than instruction-only skills. Bundled executables can hide malicious code running at the skill's trust level, and natural-language malicious instructions evade traditional malware scanners, per HiddenLayer's research. If a skill ships scripts, treat it as third-party code — because it is.

Step 2: Pin every skill to a commit SHA. Version pinning is a documented structural gap: skills can be updated post-install, and per Red Hat's guidance cited by Mondoo, an upgrade can include malicious code or vulnerabilities. Record the exact commit you reviewed, and re-check whenever upstream changes.

Step 3: Sandbox execution and limit access. Skills inherit the agent's credentials and filesystem access, so apply least privilege by default: restricted network and filesystem access, no standing permissions beyond what the task requires. The academic authors behind the 26.1% finding call for capability-based permission systems as the necessary fix.

Step 4: Scan for behavioral compromise, not just malicious code. A 312-star code review skill contained hidden instructions — invisible Unicode and HTML comments — to auto-approve "security-exempt" PRs and exfiltrate conversation context. Static analysis misses time-delayed payloads and environment-gated triggers. As HiddenLayer puts it, auditing that focuses only on malicious code misses skills that are "technically clean but behaviourally compromised."

Step 5: Maintain an org-level audit trail. In most environments, you simply don't know what skills are active across your team. Atlan's approval readiness test is a practical gate:

• What did the skill know?
• What was it allowed to do?
• Why was the action approved?
• What happened next?

These five steps map directly to what SkillzBench is building: SHA-pinned verification, security scanning, sandboxed benchmarking, per-agent loadouts, and Teams-tier allowlists with audit. The goal isn't to avoid skills — it's to adopt them with proof.

How to Evaluate a Skill Before You Trust It

The platform vendors' position is blunt: users are responsible for only running trusted skills. But that assumes you can actually verify what a skill does before running it — and as one analysis of the ecosystem notes, most people can't. Until registries add mandatory vetting, the burden of evaluation falls on you, so it's worth having a repeatable process.

Before installing any skill, work through a short pre-install check:

• Inspect for hidden instructions. A code-review skill with 312 GitHub stars was found hiding instructions in invisible Unicode and HTML comments — directing the agent to auto-approve "security-exempt" pull requests and exfiltrate conversation context. Manual reading misses these, so look specifically for non-printing characters and comment blocks.
• Check whether the skill bundles scripts. The largest empirical study found script-bearing skills are 2.12× more likely to contain vulnerabilities than instruction-only skills, because executable code runs at the skill's trust level.
• Verify provenance and maintenance. There's no cryptographic signing in the ecosystem today, so provenance can be spoofed. Look at the repository history, license, and whether upstream changes are tracked — skills can be updated maliciously after install.
• Benchmark whether it actually helps. A skill that's clean but useless still adds prompt surface without value. Test it with and without, under identical conditions, before granting it access to your agent.

That last point matters more than most people realize. Roughly 26.1% of analyzed skills carry at least one vulnerability, and 13.3% exhibit data exfiltration patterns — but a "safe" skill that degrades your agent's behavior is a different kind of liability.

This is the gap SkillzBench is being built to close. It's an independent testing lab that will publish a trust score from 0–100, combining security scanning, quality judgment, license checks, maintenance signals, and community indicators. Every skill version gets pinned to a commit SHA, so you know exactly what you evaluated. Benchmarking runs in a sandbox with the same model, with and without the skill, and the resulting Lift — measured in percentage points — is always shown separately from the rating.

That separation is deliberate. Scores and money stay decoupled so a rating can't be bought, and so you can weigh "is it safe?" and "is it useful?" as two independent questions. At launch, SkillzBench will focus on instruction-only skills, listing script-bearing skills link-out only — a direct response to the 2.12× risk multiplier.

If you want a structured way to evaluate skills before trusting them with your credentials and filesystem, join the SkillzBench waitlist at skillzbench.com. Skills, proven.