Are Claude Skills Safe? The 2026 Evidence

Mostly yes, in the same sense npm packages are mostly safe: the format is benign, the ecosystem around it is young and barely audited, and the difference between a fine install and a bad one is usually whether anyone read the file first. A SKILL.md cannot execute anything by itself — it is Markdown. The risk runs entirely through the agent that reads it: whatever your Claude session is allowed to do (read files, run shell, make network requests), an installed skill can instruct it to do. The honest framing is dependency-risk, not bookmark-risk: installing one hands a set of instructions to a process with your permissions.

Snyk's February 2026 audit was the first large-scale security review of the public skills ecosystem, scanning 3,984 skills from ClawHub and skills.sh. Findings: 13.4% contained critical-level issues, 36% of ClawHub skills carried detectable prompt injection, 1,467 distinct malicious payloads were identified, and 91% of confirmed malware combined natural-language jailbreaks with executable shell payloads. The three dominant patterns: prompt injection hidden in skill descriptions, shell payloads chained through bash tools (curl | base64 -d | sh, or 50+ subcommand chains designed to slip past deny rules), and typosquatted names cloning popular skills.

A coordinated supply-chain attack running January–February 2026: Koi Security's audit of all 2,857 then-listed ClawHub skills found 341 malicious entries — 335 traced to a single coordinated campaign — using typosquatting (names mimicking popular skills like "polymarket" and "phantom"), cross-file logic splitting to hide payloads, and credential exfiltration through external webhooks. The payload in the associated Atomic Stealer wave targeted crypto wallets and session tokens. Antiy CERT attributed 1,184 malicious skills to the campaign family overall, and variant package names remained discoverable for months. Independent audits put the malicious share between 13% and 26% of the registry at its worst.

Six steps, about ten minutes. (1) Read SKILL.md end to end — every line, including HTML comments — checking that every instruction serves the stated purpose; a code-style skill has no business mentioning .env, credentials, or network calls. (2) List every other file in the folder; SKILL.md is the part people read, scripts are the part that runs. (3) Read any bundled script before running anything. (4) Check the allowed-tools field — a reading skill requesting Bash, Edit, and Write is doing more than reading; scope beats blanket grants. (5) Check the trigger description — would it fire on prompts you don't intend? (6) Look at the source: first-party org > established author > random repo, and test project-level in a throwaway repo before promoting it user-level.

A skill is prompt content — that is the whole point — and its instructions carry full trust: the agent treats them as configuration from you, not as untrusted input like a web page. Skill prompt injection hides hostile directives inside an otherwise legitimate skill body: a buried line in a long "react-conventions" skill instructing the agent to read the project .env and include its contents in a code comment, weaken a security setting, or soften what a review reports. Unlike a hostile web page the agent happens to read, this is injection you installed — and it loads whenever the description matches. Model refusals catch some of it ("frequently" is doing heavy lifting there); the first layer of defense is that the file never gets installed.

Ranked by review rigor: the first-party anthropics/skills repo (small, maintained, tested) is the safest catalog; skills.sh (Vercel) is a leaderboard over public GitHub with install counts as trust signal but no code review; ClawHub adds vector search, signed manifests, moderated releases, and security analysis that checks declared requirements against actual behavior; skillsdirectory.com publishes its security-scanning methodology over a 294K+ index. The scraper tier (SkillsMP's 1.3M+ claim, LobeHub, agentskill.sh) is indexing, not review. No registry eliminates the read-it-yourself step — and the top ClawHub skill by downloads is "Self Improving Agent" (240K installs), a skill that rewrites its own instructions.

The documented patterns are: instructions to read .env files, SSH keys, or shell history and include the contents in output that leaves the machine (a commit, a PR description, a web request); bundled "setup" scripts that fetch and execute a second-stage payload the moment they run; quiet phone-homes sending file contents or environment variables to attacker endpoints; and dependency confusion where a nested requirements.txt pulls a typosquatted package carrying the real payload. Air Security's June 2026 scan of 142,836 live skills found 17,822 (~12.4%, 6.7M installs) resting on at least one untrusted external resource — an unpinned dependency that can turn malicious without the skill changing. Models often refuse obvious exfiltration, but "often" is probabilistic where your .env file is not.

VibeFuse loads the portable SKILL.md standard, so the same audit discipline applies — read before you run. What it adds is an economic layer: an open-source marketplace where creators sell widgets, skills, and styling packs at an 80% revenue share via Stripe Connect with creator-set pricing. Paid distribution inside the first ever free widget-based AI harness changes the incentive math that fuels registry malware — creators have a legitimate place to earn, with buyers previewing a widget running before they pay, all with local/offline processing, working in any app.