How to check an agent skill before you install it
A skill is a folder of instructions and often scripts that your coding agent follows. It runs with the same access your agent has to your files, your terminal and your accounts. Here is a short check anyone can do, what our automatic scan looks for, and what to do if something looks wrong.
Checked on
Is it safe to install an AI agent skill?
Short answer: treat a skill like code from a stranger. Most skills are fine, but a skill can tell your agent to run commands, read files or send data out, and your agent will usually do it. Before you install one, check who made it, read its SKILL.md and any scripts, and be careful with install lines that download a script and run it straight away. Anthropic gives the same advice: use skills from sources you trust, and audit everything else before you use it.
A quick check anyone can do
- Who made it? Open the GitHub repo. Look for a real author or company, recent updates and open issues that get answers. A brand-new repo with many stars and no history is a reason to slow down.
- Read the
SKILL.md. It is plain text. Check that what it tells the agent to do matches what the skill says it is for. A design skill has no reason to read your SSH keys or your browser. - Look at the scripts. Open any
scriptsfolder and the files theSKILL.mdmentions. You do not need to read every line: look for downloads, deleted folders, and anything that touches keys, passwords or browser data. - Check the install line. A line like
curl … | shdownloads a script and runs it at once. Open that script first, or install the tool another way if the README offers one. - Check what it asks to be allowed. In Claude Code, a skill's
allowed-toolsline lets it run those tools without asking you. Plugins can also add hooks and MCP servers. Read those parts before you trust the skill. - Try it somewhere safe first. Use a test folder or a copy of your project, and keep the agent in a mode where it asks before running commands. For skills that drive a browser, use a separate browser profile.
- Install one at a time. If something goes wrong, you know which skill did it.
The red flags our scan looks for
For every skill we list, we download the repo and read its SKILL.md, scripts and code files for these patterns. A flag means "read this part", not "this skill is bad".
| Red flag | What it means | When it is normal |
|---|---|---|
| pipes a downloaded script into a shell | A line like curl … | sh: a script from the internet runs straight away, without anyone reading it. | Common in installers from known tools. Open the script, or use another install route. |
| deletes files recursively | rm -rf pointed at your home folder or the root of the disk. | Cleaning up its own cache or build folder is normal. Check the path it deletes. |
| reads SSH keys | Code that opens ~/.ssh/id_… or authorized_keys, the keys that log you into servers and GitHub. | Rare. Security tools and scanners mention these paths in their own rules or comments. |
| reads browser/keychain data | Code that touches saved passwords, cookies or the keychain. | Some tools list keychains to debug app signing or store their own API key there. Check why. |
| decodes and runs hidden code | Text that is decoded from base64 and run at once, so you cannot read what it does. | Almost never needed in a skill. Treat it as a stop sign until you know what it runs. |
| sends env/secrets to a URL | Environment variables or a .env file sent to a web address. | Very rare in a normal skill. Find out exactly where the data goes. |
The scan is automatic. A person writes and checks each entry, but we do not read every line of every repo. Each skill page shows the result in its "Is it safe to install?" answer. See how we verify.
Real flags from our directory, read by hand
We opened the flagged files of some skills we list and read the matching lines. Most flags turn out to be normal, which is why you should read the line before you decide.
| Skill | Flag | File | What the line actually does |
|---|---|---|---|
| claude-ads | pipes a downloaded script into a shell | ads/SKILL.md | The matching line tells the agent to refuse curl … | bash. It is a safety rule, so the flag is a false alarm. |
| Agent Toolkit for AWS | pipes a downloaded script into a shell | setup-devops-agent/SKILL.md | The setup step installs the uv tool with its official one-line installer. Normal, but you can install uv another way first. |
| Superpowers | reads browser/keychain data | systematic-debugging/SKILL.md | An example debugging script lists your keychains and signing identities to find out why app signing fails. It does not read passwords. |
| SkillSpector | reads SSH keys | static_patterns_privilege_escalation.py | This is a skill scanner. The match is one of its own detection rules. Scanners often trip other scanners. |
| Caveman | reads SSH keys | caveman-config.js | A code comment explains how the tool blocks an attack that would swap its settings file for your SSH key. A defence, not a risk. |
Read on 2026-11-02. Repos change, so check the current version before you install.
What a scan cannot catch
- Bad instructions in plain words. A
SKILL.mdcan ask the agent to do something harmful without any code. Only reading it catches that. - Content fetched later. A skill that reads web pages or downloads files at run time can pick up harmful instructions from them. Anthropic calls this out as a particular risk.
- Updates after we checked. A safe repo can change. Our check is dated on each page.
- Everything it installs. Packages, MCP servers and plugins pulled in by the install line have their own code.
- Large repos. If a repo is too big to scan, the skill page says so.
Want a deeper check? SkillSpector scans skills and MCP servers before you install them, and the Cloudflare security audit skill audits your own code.
Already installed one that looks wrong?
- Remove it. Delete the skill folder (in Claude Code
~/.claude/skills/or the project's.claude/skills/; in Codex~/.agents/skills/or.agents/skills/), or uninstall the plugin. - Change the keys it could reach. API keys in
.envfiles, cloud and GitHub tokens, and SSH keys if the skill could read them. - Look for what it left behind. New lines in your shell start-up files, scheduled jobs, git hooks, and new MCP servers or hooks in your agent settings.
- Tell others. Open an issue on the repo and tell us so we can check the entry again.
Official guidance
- Anthropic: Agent Skills overview, security considerations Docs
- Claude Code: skills, allowed-tools and where skills load Docs
- OWASP Top 10 for LLM applications Reference