Agent Skills Security: What a SKILL.md Can Run on Your Machine, and the Audit Checklist We Use

Agent skills are as safe as the code and instructions inside them, and no safer. In Claude Code, a skill can run bundled scripts with the same network access as any other program on your computer, pre-approve its own tools for the turn it runs in, and execute shell commands before the model even reads it. Anthropic's own docs say to use skills only from sources you trust (ones you wrote, or ones from Anthropic) and to audit everything else like software you are about to install.

That advice matters more this month. On 2026-10-22 the Agentic AI Foundation took Agent Skills in as an open standard, which makes the same SKILL.md folder more likely to travel between agent products. More teams will install skills they didn't write. This post covers agent skills security in practical terms: what a skill can do on each surface, what we found when we scanned the 143 skills installed on our own machine, the 10-point checklist we use before installing one, and the settings that lock skills down for a whole team.

What we found: Of 143 skills on one of our working machines, 40 bundle scripts (257 script files), 28 have network patterns in script code (19 of them reference an HTTP client or command such as curl or requests), 17 pre-approve plain Bash with no pattern, and 17 run shell commands at load time. Scanned on 2026-10-28 with a simple pattern scanner (a trimmed version is below). These are leads to review, not verdicts.

What changed on October 22?

The Linux Foundation announced from San Jose, during AGNTCon + MCPCon, that the Agentic AI Foundation (AAIF) now hosts four new projects: Agent Skills (contributed by Anthropic), Open Responses, OpenEnv and OpenSandbox. That brings the foundation to 10 hosted projects in its first year, alongside MCP, AGENTS.md, A2A, goose, Agent Router and agentgateway.

The release describes Agent Skills as "an open format for giving agents new capabilities and domain expertise" that packages "instructions, scripts and resources in a reusable manner that agents can load on demand." David Soria Parra of Anthropic said the company launched Agent Skills a year ago and is now "donating Agent Skills to the AAIF to ensure that anyone building with skills can shape what's next."

Agent Skills was already an open format before the move; a neutral home makes it more likely that a skill written for one agent gets dropped into another, pulled from a registry you've never used, or copied from a repo you cloned this morning. The release doesn't cover how to vet a skill before you install it. That part stays with you.

What can a skill actually do on your machine?

A skill is a folder with a SKILL.md file (YAML frontmatter plus Markdown instructions) and, optionally, scripts/, references/ and assets/. The open specification requires only a name and a description. Everything else is up to the author.

Per Anthropic's Agent Skills overview, a skill loads in three stages:

1. Metadata (about 100 tokens): the name and description sit in the system prompt from startup. The description decides when the skill triggers.
2. Instructions: when a request matches, Claude reads the SKILL.md body into context.
3. Resources and code: Claude reads extra files only when referenced, and runs scripts through bash. Only a script's output enters context. In Anthropic's words, "the script code itself never enters context."

That last point is the one people miss. The model can run a skill's scripts without ever reading them. If nobody on your team read them either, nobody did.

What a script can reach depends on where the skill runs:

So the same skill folder is low-risk in an API container and high-risk on a developer laptop that holds SSH keys, cloud credentials and a checked-out production repo. Anthropic's enterprise guide rates bundled scripts as a high concern for exactly this reason: "scripts run with full environment access."

The OWASP Agentic Skills Top 10, an early-stage OWASP incubator project last updated in March 2026, ranks the same risks from the attacker's side: malicious skills sit at AST01, supply chain compromise at AST02 and over-privileged skills at AST03.

Which Claude Code features turn a skill into more than text?

Four frontmatter features in Claude Code's skills documentation deserve a line each in your review, because each one acts before or around your approval prompts.

allowed-tools pre-approves tools. It lets Claude use the listed tools "without prompting you for approval" during the turn that invokes the skill. The grant clears on your next message, and your deny and ask rules still win. The detail that matters for cloned repos: "Workspace trust doesn't gate this field. Claude Code applies a project skill's allowed-tools even in a -p run in a folder you've never trusted."

! commands run before Claude reads the skill. A line like !`gh pr diff` runs a shell command when the skill renders, and the output replaces the placeholder. The docs say "injected commands never prompt for permission while the skill renders." Each command is checked against your permission rules, and outside auto mode anything short of an allow aborts the skill. A skill that pre-approves Bash in its own allowed-tools clears that check for itself.

hooks keep running. Hooks declared in a skill's frontmatter are registered when the skill is invoked and stay active "for the rest of the session," well after the task that triggered them.

The description is a trigger. Unless a skill sets disable-model-invocation: true, Claude can load it by itself whenever a request matches its description. A broad description means the skill runs on tasks you didn't have in mind. Skills in a nested .claude/skills/ folder also load the first time Claude reads or edits a file in that subdirectory, so a vendored folder can bring its own skills.

Watch out: Two items on the checklist below combine badly. A skill that reads local files into context (through ! commands or scripts) and also has network access has everything it needs to move that data somewhere else. Anthropic's checklist asks you to "consider the combined risk when a Skill uses both file-read and network tools together."

What did we find when we scanned our own 143 skills?

We ran a short Python scanner over the personal (~/.claude/skills/) and project (.claude/skills/) skill folders on one of our working machines on 2026-10-28. It found 143 skills. It counts patterns; it doesn't judge intent, so every number below is a list of things to read, not a list of problems.

Three things stood out when we read the matches.

First, every one of the 17 load-time commands was read-only (cat, head, tail, ls, grep, sed -n and date, with echo fallbacks), mostly pulling local Markdown notes into context. That's the intended use. It's also exactly the file-read half of the combination Anthropic warns about, so those skills went on our list to check for network tools.

Second, several skills that grant plain Bash bundle no scripts at all. The pre-approval exists so the agent can run commands the instructions describe. That's convenient, but it means the review has to cover the Markdown instructions as closely as the code.

Third, the scanner is crude by design. A URL in a comment counts as a network call, and a credential check by regex throws false positives on placeholder values. Treat any scanner, ours included, as a way to decide what to read first.

A trimmed version of the scanner, if you want to run the same checks:

import os, re, sys
NET = re.compile(r'\b(curl|wget|requests\.(get|post)|urllib|fetch\(|httpx|axios|https?://)', re.I)
INJECT = re.compile(r'(^|\s)!`[^`]+`|^`{3}!', re.M)
EXT = ('.py', '.sh', '.js', '.mjs', '.ts', '.rb', '.ps1', '.cjs')
for root in sys.argv[1:]:
    for dp, dn, fn in os.walk(os.path.expanduser(root)):
        dn[:] = [d for d in dn if d not in ('node_modules', '.git', '.venv')]
        if 'SKILL.md' not in fn:
            continue
        md = open(os.path.join(dp, 'SKILL.md'), errors='ignore').read()
        fm = md.split('---')[1] if md.startswith('---') else ''
        scripts, net = 0, False
        for sdp, sdn, sfn in os.walk(dp):
            sdn[:] = [d for d in sdn if d not in ('node_modules', '.git', '.venv')]
            for f in sfn:
                if f.endswith(EXT):
                    scripts += 1
                    net |= bool(NET.search(open(os.path.join(sdp, f), errors='ignore').read()))
        grants = re.search(r'^allowed-tools\s*:(.*(?:\n\s+-.*)*)', fm, re.M)
        print(dp, f'scripts={scripts}', f'net={net}',
              f'allowed-tools={" ".join(grants.group(1).split()) if grants else "-"}',
              f'inject={bool(INJECT.search(md))}', f'hooks={bool(re.search(r"^hooks\s*:", fm, re.M))}')

Run it with python3 scan_skills.py ~/.claude/skills .claude/skills. It reads files and prints one line per skill; it changes nothing.

The 10-point skill audit checklist we use

This builds on the 8-step review checklist in Anthropic's Skills for enterprise guide and adds the Claude Code specifics from the section above. Do it once per skill and again for every new version.

1. Read every file in the folder. SKILL.md, every referenced Markdown file, every script, every asset. Anthropic's first step is the same, and it's the one we see skipped most.
2. Match the scripts to the stated purpose. A PDF skill has no reason to read ~/.aws or call an unknown domain. Run the scripts once in a sandbox with no real credentials and compare what they do to what the description says.
3. Search for network calls. http, curl, wget, fetch, requests, urllib, httpx. For each hit, write down the domain and why the skill needs it. Check where redirects land.
4. Search for adversarial instructions. Lines that tell the agent to skip confirmations, hide actions from the user, behave differently on certain inputs, or include file contents in its reply. Anthropic lists exfiltration "through Claude's conversational responses" as its own pattern.
5. Check for hardcoded credentials. API keys, tokens and passwords belong in environment variables or a secret store, never in skill files, where they end up in Git history and in the context window.
6. Read the allowed-tools line. Plain Bash is a blank cheque for that turn. Ask for scoped patterns such as Bash(gh pr *), and treat package runners (npx *, uvx *, pip install *) as unscoped.
7. Read every ! command. These run at render time with no prompt if your rules allow them. Read-only commands are normal; anything that writes, installs or calls the network at load time needs a reason.
8. Check for hooks in the frontmatter. Skill hooks keep running for the rest of the session. Know what each one does and when it fires.
9. Read the description as a trigger rule. If it would match tasks unrelated to the skill's job, narrow it, or set disable-model-invocation: true so the skill only runs when someone types /name.
10. Pin the version you reviewed. Install from a commit hash or a tagged release, record a checksum, and review the diff on every update. Anthropic's guide says to "treat every update as a new deployment requiring full security review." External dependencies count too: a skill that fetches instructions from a URL can change without its files changing.

Tip: Keep a short registry per skill: purpose, owner, source and pinned version, dependencies (MCP servers, packages, external services) and the date of the last review. Anthropic recommends a similar registry (purpose, owner, version, dependencies, evaluation status), and it turns "who installed this?" into a lookup instead of an investigation.

If your skills also lean on MCP servers, the same review applies to those servers' tools; we cover that in our MCP security guide. For the wider set of agent controls (permission scoping, sandboxing, audit logs, human gates), see AI agent security best practices.

How do you lock skills down for a whole team?

Individual review doesn't scale past a handful of people. These are the controls Claude Code and Anthropic's platform give you today, all from the docs linked in this post:

A practical default for most teams: set disableSkillShellExecution in managed settings, and allow only the skills you have reviewed with Skill(name) rules. If you can maintain the allow list centrally, add allowManagedPermissionRulesOnly too, knowing that it also ignores developers' own permission rules, so every approved tool pattern has to live in managed settings. Store approved skills in one Git repo with pull-request review, and keep skill authors from approving their own skills, which is Anthropic's separation-of-duties advice.

If you're choosing between packaging a capability as a skill or a plugin, the security surface differs; our skills vs plugins comparison covers the trade-off.

When should you get an outside audit?

You don't need one if your team runs a few skills that you wrote, scoped, and keep in your own repo. The checklist above and an afternoon are enough.

It's worth bringing someone in when any of these are true:

• Developers install skills and plugins from several public registries, and nobody owns the list.
• Skills run on machines that hold production credentials, customer data or signing keys.
• You're rolling Claude Code, Copilot or Cursor out to a whole engineering team and need permission settings that hold up without a prompt on every command.
• Compliance asks how you control what AI coding agents can read, run and send, and you don't have a written answer.

Our Claude Code security audit covers what your AI coding agents can read, run and send (files and secrets, shell commands, MCP servers, prompt-injection paths, permissive agent settings), plus the dependency and plugin install process. If skills are your main concern, say so on the call and we'll tell you whether the audit fits. For a team of up to 20 developers it runs 1 to 2 weeks and ends with a written report of prioritized findings plus a hardened configuration package. The first call is free, and we name your top exposure points on it.

If you'd rather have skills built and reviewed for you from the start, our Claude Code agency team writes scoped skills, and the Claude Code skills workflow shows how we structure them.

FAQ

Are AI agent skills safe to install?

A skill is as safe as the code and instructions inside it. Anthropic's docs say to use skills only from trusted sources, meaning ones you wrote or ones from Anthropic, and to audit anything else thoroughly before use. In Claude Code, a skill's scripts have the same network access as any other program on your computer, so treat installing one like installing software.

Can a Claude skill run code on my computer?

Yes, in Claude Code. Skills can bundle scripts that Claude runs through bash, and only the script's output enters the model's context, so the model doesn't read the code it runs. On the Claude API, skills run in a sandboxed container with no network access, which limits what a script can reach.

Does Claude Code ask permission before a skill runs commands?

Not always. A skill's allowed-tools field pre-approves the listed tools for the turn that invokes it, and ! commands in a skill run at render time without a prompt when your permission rules allow them. Deny and ask rules still override allowed-tools, and admins can disable ! commands with disableSkillShellExecution.

What is the Agentic AI Foundation, and why does it matter for skills?

The Agentic AI Foundation (AAIF) is a foundation hosted by the Linux Foundation that gives open agent projects a neutral home, including MCP and AGENTS.md. On 2026-10-22 it took Agent Skills in from Anthropic as an open format, which makes skills more portable across agent products. Portability means more skills from more sources, so review practices matter more, not less.

How do I audit a SKILL.md file?

Read every file in the skill folder, compare what the scripts do with the skill's description, and search for network calls, hardcoded credentials and instructions that hide actions from the user. In Claude Code, also check the allowed-tools line, every ! command and any hooks. Pin the version you reviewed and re-review every update.

Does Anthropic scan skills for malware?

Claude Enterprise organizations can turn on skill and plugin security scanning for skills uploaded or edited in claude.ai and Cowork. It doesn't cover skills uploaded through the Skills API or Console, skills already present when scanning was turned on, or orgs with certain data handling setups such as ZDR. Anthropic says scanning complements a manual review rather than replacing it.

Should I disable skills in Claude Code entirely?

Usually not. Skills you wrote and scoped are one of the most useful parts of Claude Code. A better default is to block ! commands with disableSkillShellExecution in managed settings, then allow the specific skills you've reviewed with Skill(name) permission rules.

---

Sources: Linux Foundation: Agentic AI Foundation announces four new projects (2026-10-22), Anthropic: Agent Skills overview, Anthropic: Skills for enterprise, Claude Code docs: Skills, Agent Skills specification, OWASP Agentic Skills Top 10: AST01, all read 2026-10-28. Skill counts: our own scan, 2026-10-28.