Skills Are Everywhere — But Nobody Knows Which Ones to Trust

The skills ecosystem is growing faster than anyone can vet it — and the numbers tell a story of explosive adoption colliding with near-zero gatekeeping. Daily skill submissions jumped from under 50 in mid-January 2026 to over 500 by early February, a 10x surge in a matter of weeks. Publishing a skill requires nothing more than a SKILL.md Markdown file and a GitHub account one week old. No code signing. No security review.

The consequences are already measurable. Snyk's audit of 3,984 skills found that 36.82% carried at least one security issue, and 13.4% — 534 skills — contained a critical flaw. Snyk's blunt assessment: if you installed a skill in the past month, there's roughly a 13% chance it contains a critical vulnerability and "a non-zero chance it's actively exfiltrating your credentials right now."

The researchers draw an uncomfortable parallel. The ecosystem resembles early npm or PyPI before security became a first-class concern — but with a twist that makes it worse: skills run with high default privilege, and prompt injection has no real analog in traditional code-based detection.

What Snyk actually found in the wild includes:

• 76 confirmed malicious payloads, with 8 malicious skills still live on ClawHub at publication
• Hardcoded secrets in 10.9% of all ClawHub skills — rising to 32% among malicious samples
• Obfuscated data exfiltration, including base64-encoded theft of ~/.aws/credentials
• External malware distribution, including password-protected ZIPs designed to evade scanners

Anthropic's own position puts the burden squarely on users: skills are "intentionally designed to execute code," and it is "the user's responsibility to only use and execute trusted Skills." The company's engineering blog warns that malicious skills may introduce vulnerabilities or direct Claude to exfiltrate data, recommending installation only from trusted sources. But it offers no independent way to determine which skills qualify as trusted.

That's the gap this article keeps circling back to. You want the productivity gains — the document handling, the workflows, the specialized expertise skills deliver. But the ecosystem gives you no signal to separate a genuinely helpful skill from one that quietly exfiltrates your credentials. Star counts and download numbers don't measure safety or usefulness.

This is the problem SkillzBench is being built to solve: an independent lab that security-scans, validates, and benchmarks skills in a sandbox — testing each one with the same model, with and without the skill, so you can see whether it actually helps before you ever equip it. Skills should earn their place in your workflow, not just show up in search results.

Join the SkillzBench waitlist — Skills, proven.

How Claude Skills Actually Work: SKILL.md, Progressive Disclosure, and the Open Standard

Beneath the hype, a Claude Skill is a remarkably simple artifact: a folder of files, anchored by one Markdown file. Anthropic's engineering team describes building one as "like putting together an onboarding guide for a new hire" — instructions, scripts, and reference material an agent loads on demand.

Every skill centers on a SKILL.md file with YAML frontmatter containing two fields: name and description. Per the official API documentation, names cap at 64 characters (lowercase letters, numbers, hyphens only), descriptions at 1024 characters. The description does the heavy lifting — it's what Claude reads to decide when to activate the skill.

The design's elegance lies in progressive disclosure, which keeps context costs low while allowing what Anthropic calls "effectively unbounded" bundled content. It works in three tiers:

• Level 1: Only `name` and `description` metadata load at startup — always.
• Level 2: The full SKILL.md body loads only when Claude judges it relevant to the task.
• Level 3: Additional bundled files (references, templates, scripts) load only as needed during execution.

Skills can also bundle executable scripts. The official PDF skill, for instance, includes a Python script that extracts form fields — Claude runs it as a deterministic operation rather than loading its content into context.

The API enforces concrete constraints: a maximum of 20 skills per request and a 30 MB uncompressed upload cap across all files combined. Skills run across the entire Claude ecosystem — Claude.ai (paid plans), Claude Code (via plugin marketplaces), the Claude Agent SDK, and the Messages API, where both pre-built (pptx, xlsx, docx, pdf) and custom skills integrate identically.

On December 18, 2025, Anthropic published Agent Skills as an open standard, so a skill can now be built once and deployed across any skills-compatible agent — not just Claude. The official repo has accumulated 17,000+ GitHub stars since the October 2025 launch, and a DeepLearning.AI course built with Anthropic now teaches the format alongside MCP and subagent patterns.

That portability cuts both ways. The same SKILL.md simplicity that makes skills easy to author makes them easy to distribute unchecked — which is why SkillzBench is building independent verification and cross-agent benchmarking for the emerging skills ecosystem, pinning every version and testing each skill in a sandbox before it earns a trust score.

The Security Gap: One Consent Can Become Total Compromise

One click of "approve" is all it takes. That's the uncomfortable conclusion security researchers reached after demonstrating that a modified Claude skill could execute ransomware with no further prompts, logs, or warnings.

Cato CTRL's proof-of-concept weaponized Anthropic's own open-source GIF Creator skill, adding a hidden post_save helper that fetched and executed an external script. In a controlled environment, the chain delivered a live MedusaLocker attack with full file encryption — after a single initial consent. Cato calls this the "single-consent trust model": once approved, a skill gains persistent permissions to read and write files, download and execute code, and open outbound connections. As threat researcher Inga Cherny put it, "one consent can become total compromise for an enterprise" (Cato CTRL).

Snyk's audit of 3,984 skills from ClawHub and skills.sh quantifies the broader problem: 13.4% carry at least one critical security issue, 36.82% have some security issue, and researchers confirmed 76 malicious payloads — with 8 still live on ClawHub at publication. Notably, 91% of confirmed malicious skills also employ prompt injection, an attack class with no true analog in traditional code scanning (Snyk's ToxicSkills research). Snyk's findings include:

• Hardcoded secrets in 10.9% of all ClawHub skills — and 32% of malicious samples
• Suspicious downloads in 10.9% of skills; direct money access in 8.7%
• A coordinated February 2026 campaign of 30+ malicious skills targeting Claude Code and OpenClaw users
• Daily submissions exploding from under 50 to over 500 in weeks, with publishing requiring only a week-old GitHub account

Anthropic's position is candid: skills are "intentionally designed to execute code," and "it is the user's responsibility to only use and execute trusted Skills." The company's own engineering blog warns that malicious skills may introduce vulnerabilities or direct Claude to exfiltrate data, and its repo advises users to "always test skills thoroughly in your own environment" (Anthropic's skills repository).

That guidance is reasonable — and, at scale, nearly impossible to follow. Auditing every SKILL.md and bundled script, reproducing upstream versions, and sandbox-testing each skill against your own workflows is a full-time engineering discipline, not a checkbox. Snyk compares the ecosystem to early npm or PyPI, before security became a first-class concern.

This is exactly the gap independent verification exists to close. SkillzBench is building a control panel for exactly this workflow — pinning every skill version to a commit SHA, security-scanning and license-checking each release, and benchmarking skills in a sandbox with the same model, with and without the skill, so teams don't have to trust blindly. When one consent can mean total compromise, "audit everything yourself" isn't a strategy — it's a signal that the ecosystem needs infrastructure built for the problem.

What Trustworthy Skill Adoption Looks Like: Verify, Benchmark, Equip

Anthropic's own repository carries a blunt disclaimer: "Always test skills thoroughly in your own environment before relying on them for critical tasks." That advice is sound, but it leaves teams to figure out how — in an ecosystem where Snyk's audit of 3,984 skills found 13.4% with at least one critical issue and 36.82% with any security issue.

Trustworthy adoption needs a repeatable pipeline, not good intentions. Four practices turn Anthropic's warning into an operational framework:

• Pin every skill to a commit SHA — "latest" is a moving target, and upstream edits can silently change behavior.
• Security-scan and license-check before install, since publishing a skill requires only a SKILL.md file and a week-old GitHub account.
• Benchmark in a sandbox, running the same model with and without the skill to measure Lift in percentage points.
• Control what each agent sees via per-agent loadouts, because a skill you never enabled can't hurt you.

The sandbox requirement isn't paranoia. Cato CTRL demonstrated that a modified version of Anthropic's own GIF Creator skill could execute a live MedusaLocker ransomware chain — full file encryption, no further prompts, no warnings — after a single initial consent. As threat researcher Inga Cherny puts it, "one consent can become total compromise for an enterprise."

This is exactly the gap SkillzBench is being built to close. Its five-pillar pipeline — Discover, Verify, Benchmark, Equip, and Stay current — operationalizes each step: continuously crawling and deduplicating skills from GitHub, pinning every version to a commit SHA with validation, license checks, security scans, and quality judging, then testing skills in a sandbox with the same model, with and without the skill, and publishing the Lift.

Two design choices matter most. First, a 0–100 trust score draws from security, quality, license, maintenance, and community signals — and Lift is always shown separately from ratings, so a skill that's safe but useless never looks "good" overall. Second, money never touches scores. At launch, the focus is instruction-only skills (SKILL.md plus text references); script-bearing skills will be listed link-out only, reflecting the higher risk of executable code.

For teams that would rather adopt skills than audit them one by one, that pipeline — plus per-agent loadouts where each agent only sees what was chosen for it — is the difference between hoping a skill helps and knowing it does.

Your Action Plan: Adopt Skills Without the Blind Trust

The good news: you don't have to choose between using Skills and staying safe. Security researchers have published concrete safeguards, and adopting them takes minutes — not a security team.

Start with Cato CTRL's guidance: treat every skill as an executable. That means running Claude in a sandbox or VM with limited filesystem and network permissions, and actively monitoring file writes, subprocess creation, and outbound connections. This matters because Cato's researchers showed that a modified official Anthropic skill executed a live MedusaLocker ransomware chain with no secondary prompts, logs, or warnings — a "consent gap" where hidden helpers act behind the scenes after a single approval.

Next, prefer instruction-only skills over script-bearing ones whenever possible. A skill that's just a SKILL.md plus text references can still carry prompt injection, but it can't fetch and execute an external script the way Cato's proof-of-concept did. When a skill does bundle code, verify the source and read it before granting consent — Anthropic's own position is that it's "the user's responsibility to only use and execute trusted Skills."

Also check licenses and upstream maintenance before adopting anything from the ecosystem. The scale of the problem justifies the diligence: Snyk's audit of 3,984 skills found 13.4% with at least one critical issue and 36.82% with any security issue, and daily submissions jumped from under 50 to over 500 in a matter of weeks. A skill published last month by a week-old GitHub account deserves the same scrutiny you'd give an unfamiliar npm package.

Your practical checklist:

• Run agents in sandboxes or VMs with restricted filesystem and network access
• Monitor subprocess creation and outbound connections during skill execution
• Choose instruction-only skills over script-bearing ones where the task allows
• Check the license and how actively the upstream repo is maintained
• Audit any skill you didn't write before trusting it with real work

The harder problem is that manual vetting doesn't scale — Snyk found 76 confirmed malicious payloads across the ecosystem, and eight malicious skills were still live at publication. That's why independent verification infrastructure is emerging. SkillzBench is building exactly this layer: continuous discovery and deduplication of skills from GitHub, version pinning to commit SHAs, security scanning and license checks, sandboxed benchmarking that measures each skill's Lift in percentage points against the same model without it, and a 0–100 trust score where money never touches ratings. At launch it will focus on instruction-only skills, with script-bearing skills listed link-out only.

If you want early access to that verification layer as it ships, the SkillzBench waitlist is open now — join to get notified when independent benchmarking, security scans, and per-agent loadouts go live. Until then, the rule stands: skills are proven, but trust is earned per skill.