Key findings
We scanned all 61 Claude skills in the CAIS Skill Library with SkillSpector, NVIDIA’s open-source security scanner for agent skills. It flagged 22 lines in 13 skills, and every one was harmless once we read it in context. The behavior a business team actually needs to know about sat in lines the scanner never flagged.
- No skill had a confirmed finding. All 61 ended with a risk score of 0 after review. Nine came back “caution” only because the scanner couldn’t fully cover a file, usually because the skill points to a file that isn’t in its folder.
- 22 flags, all false alarms in context. Fourteen were “acts without approval” matches on lines that require approval, describe a read-only step, show an example of what not to do or tell Claude not to pester you about connecting tools. Six were the same permissions sentence repeated across Anthropic’s sales skills.
- The scanner missed what mattered. Reading the skills line by line, we found 11 that can do more with your apps or data than a quick read suggests. One sends payment reminders straight to customers after a single batch approval. Others notify customers, send calendar invites, create sprints, publish to a wiki or file tickets with no approval step written in. None of those lines was flagged.
- Two data skills run their own SQL with no read-only rule. Data Analysis and Dataset Explorer write queries and run them on a connected warehouse, and neither tells Claude to stick to reading.
- Only 1 of 61 skills ships code files. Most of SkillSpector’s checks look at code. On instruction-only skills it falls back to matching phrases, which is where the false alarms came from.
- The static scan was repeatable; the AI pass wasn’t. Rescanning the first 39 skills on November 9 gave results identical to the October scans. SkillSpector’s optional LLM pass returned different findings on unchanged files, so we don’t use it to decide what gets published.
- Anthropic’s own license file has stray text in it. The root LICENSE of anthropics/knowledge-work-plugins, the source of 54 of our skills, ends with nine lines of unrelated text added in pull request #193. It was still there on November 9, 2026.
For a business team, the short version: a scanner is a good first filter for malicious code. It can’t tell you what a skill will do with your email, helpdesk, tracker or database. Reading the skill can.
Why scan Claude skills at all
A skill can act with whatever access you’ve given Claude. A skill is a folder of instructions, and sometimes scripts, that Claude loads when a request matches its description. With connectors switched on, those instructions can tell Claude to send email, update a ticket, create a calendar event or send a payment reminder through apps you’re signed into.
There’s no app-store review in between. Skills spread through GitHub repos and directory sites, and most people install one by copying a folder. That’s why we scan before we publish, and why every skill page in our library says what the scan found.
SkillSpector is NVIDIA’s free scanner for agent skills. Help Net Security describes 64 detection patterns covering risky code, known malware, prompt injection, hidden text, credential access and vulnerable dependencies. Each scan returns a risk score from 0 to 100. An optional second pass sends flagged content to a language model to weed out false positives.
How we scanned
We scanned each skill exactly as a reader downloads it, then read every flagged line by hand. The 61 skills come from four public repositories, each pinned to one commit and copied unmodified.
| Source repository | Skills | License |
|---|---|---|
| anthropics/knowledge-work-plugins | 54 | Apache-2.0 |
| alirezarezvani/claude-skills | 5 | MIT |
| anthropics/skills | 1 | Apache-2.0 |
| coreyhaines31/marketingskills | 1 | MIT |
- Scan the shipped ZIP. SkillSpector 2.12.0 in static mode, run on October 20, 2026 for the first 20 skills, October 26 for the next 19 and November 9 for the last 22, when we also rescanned the first 39. Together the skills hold 116 files; 51 are a single SKILL.md.
- Read every flag. A flag is accepted only with a written reason pinned to its rule, file and matched phrase. Anything new or unexplained blocks that skill from publishing.
- Read the skill against our page. We checked every claim on each page against the source lines, especially what the skill does through connected apps and where it asks for approval.
- Publish the result. Each skill page shows the scan date, version and outcome, with a plain-language note on every flag. The download is rebuilt from the source repository and each file is checked by SHA-256 against the bytes we scanned.
We ran without the LLM pass (--no-llm). On the first batch it returned different findings for unchanged files from one run to the next, which makes it unusable as a publish gate. Where its first-run findings were accurate, we kept them on the skill’s page.
What the scanner flagged
The static scan matched 22 lines across 13 skills, under four rules. None turned out to be an instruction to do something risky.
| Rule | What it looks for | Matches | Skills | What the line actually was |
|---|---|---|---|---|
| Autonomous action (EA2) | Phrases like “without approval” or “do not ask the user” | 14 | 7 | Lines that require approval, a note that a step is read-only, examples labeled as what not to do, a sentence about what meetings cost, and a line telling Claude not to ask you to connect tools |
| Anti-refusal (AR1) | “Never refuse” | 6 | 6 | One sentence, repeated in Anthropic’s sales skills, that lets your connector permission settings decide what Claude may do |
| No tool scope (LP3) | A skill that doesn’t list the tools it may use | 1 | 1 | Three small Python scripts that read meeting notes and print results, with no network access or file writes |
| Scope expansion (EA3) | “Expand scope” | 1 | 1 | A sample interview rubric describing a candidate’s behavior |
Nine skills came back “caution” with no confirmed findings, because the scanner marked its coverage of a file as partial. Eight point to a file that isn’t in the folder, such as your own legal playbook or Claude’s own spreadsheet instructions, or contain an example that only looks like a file path; one of them, Dashboard Builder, also has a code template too long for the scanner’s parser. In the ninth, Feature Spec Writer, the scanner reported text it couldn’t fully evaluate as possibly obfuscated. We found no hidden characters, comments or encoded text, and the flag disappeared when we scanned each half of the file separately.
Missing files are common: 41 of the 61 skills mention 68 files they don’t include, mostly sibling files from the plugin each skill was taken from. A skill installed on its own still runs, but some steps will have less to work from.
Why phrase matching gets it backwards
The scanner flagged the safety rails and passed over the actions. A phrase rule sees the words “without approval” but not the “do not” in front of them, so the lines most likely to trip it are the ones written to stop Claude from acting alone. A line that simply tells Claude to act has no warning words to match.
| Skill | Line | Flagged? | What it means |
|---|---|---|---|
| Bill Processing | “Do not send a vendor email without approval.” | Yes | A guardrail |
| Hiring Screener | “Nothing sends without approval.” | Yes | A guardrail |
| Cash Flow Snapshot | “This skill is read-only — no approval gate…” | Yes | Nothing to approve |
| Feature Spec Writer | “Do not ask the user to connect tools” | Yes | Don’t nag about setup |
| Ticket Triage | “Notify the customer that this is a known issue being tracked” | No | Contacts a customer, no approval step |
| Onboarding Plan | “Create Day 1 calendar events and Week 1 meeting invites automatically” | No | Sends invites, no approval step |
| Change Request | “Create the change request ticket automatically” | No | Files a ticket, no approval step |
| Overdue Invoice Chaser | “PayPal invoices: send the reminder via PayPal.” | No | Contacts a customer after one batch approval |
This isn’t a knock on SkillSpector. Its strengths are code, malware signatures and hidden text, and almost none of these skills contain code. For instruction-only skills, a phrase scan is a smoke alarm, and what a skill does with your apps is a question for a person reading it.
What a person reading the skills found
None of these are security bugs. They’re capabilities a team should know about before connecting the apps involved, and the scanner flagged none of these behaviors.
| Skill | What it can do once apps are connected | Approval written into the skill |
|---|---|---|
| Overdue Invoice Chaser | Sends PayPal and Stripe reminders straight to customers, and can create Airwallex pay links | One approval covers the whole batch |
| Ticket Triage | Links a duplicate ticket, adds notes, raises priority and tells the customer it’s a known issue | None |
| Onboarding Plan | Creates the new hire’s Day 1 events and Week 1 meeting invites | None |
| Sprint Planner | Creates the sprint and assigns items in your tracker, and shares the plan in chat | None |
| Change Request | Creates the change ticket “automatically” and posts updates to team channels | None |
| Runbook Writer | Publishes the finished runbook to your ops wiki | None |
| Data Analysis | Writes and runs its own SQL on a connected warehouse | No rule to stay read-only |
| Dataset Explorer | Runs profiling queries on a connected warehouse | No rule to stay read-only |
| Dashboard Builder | With no data supplied, fills the dashboard with realistic sample data, labeled as sample | Not applicable |
| Bill Processing | Approves bills in Ramp and marks them ready to sync; adds new vendor records | Asks first |
| Cash Flow Snapshot | Creates a new Notion page or Canva doc for each forecast, if that’s your saved output | Not needed (no outside contact) |
The data skills deserve a specific note. The queries they write will almost always be reads, but nothing in either skill says so, so connect your warehouse with a read-only database user. Dashboard Builder also embeds the data in the HTML file it builds, so anyone you send that file to can see all of it.
One HR skill raised a different question. Performance Review’s template has fields for an overall rating and a compensation recommendation, and nothing in the skill says the manager must supply them. Claude will fill them in unless told not to.
Our own first draft got some of this wrong. Our page copy said Ticket Triage would never change a ticket or contact a customer, and that the manager makes every rating call in Performance Review. A line-by-line check against the source caught both before publishing, and each page now says what the skill actually does.
The license file problem
The root LICENSE file in anthropics/knowledge-work-plugins is the Apache 2.0 text followed by nine lines of unrelated text, starting “Syntax-file, code seperations”. They came in through pull request #193, titled “Update LICENSE with syntax-file and code integration”.
It doesn’t change what the skills do, but anyone redistributing them copies that file. Our downloads ship the clean copy of the same license from the repo’s sales/ folder at the same commit.
What to check before installing any Claude skill
Run a scanner, then spend ten minutes reading. These checks catch everything in the tables above.
- Search the skill for action verbs. Look for send, notify, create, post, publish, approve, pay and invite. Each one is something the skill may do through a connected app.
- Find the approval step for each action. If a skill sends or changes something, it should say it shows you the result and waits for a yes. Where it doesn’t, ask Claude to propose that action instead of taking it.
- Check connector permissions, not just the skill. Your connector settings (allow, ask or block per tool) are the real limit. Setting write tools to “ask” covers any skill that forgot an approval step. For a data warehouse, connect a read-only user.
- Look for code. A
scripts/folder or.py,.shor.jsfiles deserve a full read before anything runs. - Check what it reads. A skill that pulls from Slack, email or Drive for a company-wide document can carry private details into the draft.
- Note the files it mentions but doesn’t include. Missing reference files mean thinner output, not danger, but they explain why a skill copied out of a larger plugin can underperform.
- Pin the version. Copy a skill from a specific commit, not a branch that can change after you’ve read it.
New to skills? Our guide, Getting Started with Agent Skills, covers what a skill is and how it differs from a prompt.
FAQ
Are Claude skills safe to install?
Most public skills are plain instructions with no code, and none of the 61 we scanned contained anything malicious. The risk is less about hidden attacks and more about what a skill is allowed to do with your connected apps, so read it and set connector tools to “ask” before you rely on it.
Is SkillSpector enough on its own?
No. It’s a useful first filter for code, malware patterns and hidden text. On instruction-only skills it matches phrases, which in our scan produced 22 false alarms and missed the 11 skills whose actions mattered most.
Should I use SkillSpector’s AI pass?
It can help explain findings, but in our runs it gave different results on the same unchanged files. Treat it as a second opinion, not a pass or fail.
What does a scan like this cost?
Nothing but time. SkillSpector is free and the static scan takes seconds per skill. The reading is where the time goes, including checking our own page copy against the source.
Where can I see the results for each skill?
Every skill page in the CAIS Skill Library shows its scan date, scanner version and a plain-language note on each flag.
