Before you install a Claude skill from GitHub, check these things

Since 2 October, Anthropic's security scan for third-party skills and plugins has been on by default for Claude Enterprise organisations that had not chosen a setting themselves. The reason is simple: a SKILL.md file looks like plain text, but a skill can tell Claude to run scripts, call websites and work with your files.

The scan covers skills uploaded at claude.ai and in Cowork. It does not cover skill folders you copy from GitHub into Claude Code yourself, and it does not help if you are not on Enterprise. For developers, students and small businesses outside Enterprise plans, the checking is up to you. Here is what Anthropic and independent researchers say, and what to look at before you install.

What the Enterprise scan does

According to Anthropic's help centre, the scan checks third-party skills and plugins, including skills bundled inside a plugin, when someone uploads or edits them. Most scans take one to two minutes, with three possible results:

• Pass: the skill installs normally.
• Warn: Claude could not fully verify it. It stays usable behind a caution banner that the user has to acknowledge.
• Fail: malicious content was found. The skill is blocked, and admins can't approve it.

The scan does not cover skills that were already in the organisation before scanning was turned on, skills created with Claude, skills shared through an MCP server, or MCP servers and hooks. Organisations using CMEK, ZDR or HIPAA setups are left out. Anthropic's API docs add that skills uploaded through the Skills API or the Claude Console are not scanned either. The help centre says a pass "isn't a guarantee that a skill is safe in every respect".

Why skills need checking

Anthropic's own advice is to use skills only from trusted sources, "those you created yourself or obtained from Anthropic". Its documentation lists the risks: a malicious skill can misuse tools such as bash and file operations, send data to outside systems, or fetch instructions from a URL whose content changes later.

Where the skill runs makes a difference. On the Claude API, skills run in a sandbox with no network access. In Claude Code, Anthropic says skills have the same network access as any other program on your computer.

Two Claude Code features deserve attention:

• allowed-tools in a skill's frontmatter can pre-approve tools. The docs warn that workspace trust does not gate this field. Claude Code applies a project skill's allowed-tools even in a non-interactive (-p) run in a folder you have never trusted, so a skill checked into a repository can grant itself broad access.
• Lines starting with ! run shell commands before the skill's text reaches Claude.

Independent research points the same way. A study posted on arXiv on 15 January 2026, "Agent Skills in the Wild", analysed 31,132 skills collected from two marketplaces. It found that 26.1% had at least one vulnerability and 5.2% showed high-severity patterns that suggest malicious intent. Skills that bundle scripts were 2.12 times more likely to have a vulnerability than skills made only of instructions.

A checklist before you install

1. Read the whole folder, not just SKILL.md. Open the scripts, reference files and anything that isn't text.
2. Search for network calls such as curl, wget, fetch or requests, and for URLs you don't recognise. A skill that formats reports has no obvious reason to reach the internet.
3. Check the frontmatter for allowed-tools, and the body for ! lines.
4. Look for hidden instructions, such as long encoded strings or text telling Claude to ignore what you asked.
5. Look at the repository itself: who maintains it, when it was last updated, its open issues, and whether a recent commit changed something you didn't expect.
6. Stick to a version you have read instead of always pulling the latest commit.

Well-known projects fix these problems too. Superpowers 7.0, released on 10 October, closed a Windows gap where a repository could plant a bash.cmd file that ran when a session started.

Tools that help

• A Claude Code setting. Setting "disableSkillShellExecution": true stops ! commands in user, project and plugin skills. Anthropic says this works best in managed settings, where users can't override it.
• /skill-doctor in Claude Code lists your skills, what each costs in context and how often it is used. It is a quick way to find skills you forgot you installed.
• NVIDIA SkillSpector, an open-source scanner under the Apache 2.0 licence. Its README says it checks 71 vulnerability patterns across 17 categories, including prompt injection and data exfiltration. Version 2.12.0 was published on 23 September. A scan without the optional AI review looks like this:

uv tool install git+https://github.com/NVIDIA/skillspector.git
skillspector scan ./my-skill/ --no-llm

A scanner gives you a second opinion. It doesn't replace reading the code.

Read also

• Superpowers 7.0 rebuilds brainstorming, a year after the skills framework launched
• Claude Code now brings your claude.ai skills to the terminal

Sources

• Claude Help Center, Get started with skill and plugin scanning, checked 13 October 2026
• Claude Help Center, Release notes, entry for 6 August 2026
• Claude Platform Docs, Agent Skills: security considerations, checked 13 October 2026
• Claude Code Docs, Extend Claude with skills, checked 13 October 2026
• arXiv, Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale, 15 January 2026
• GitHub, NVIDIA/SkillSpector release v2.12.0, 23 September 2026
• GitHub, obra/superpowers release v7.0.0, 10 October 2026