Claude Skill Security: A Sober Look at Marketplace Risks

The question of whether it is safe to install skills from a Claude skill marketplace is not a theoretical one. At SkillProof, we don’t speculate; we install and run them. Our entire catalog is built on the experience of pulling skills directly from public marketplaces and GitHub repositories, running them on real work, and publishing the results, whether they pass or fail. This process gives us a direct, practical view of the Claude plugin marketplace security landscape.

The short answer is that the ecosystem has started to add checks, but none of them tell you whether a skill actually works or what it will do on your machine. There is no code signing. The screening that does exist is automated pattern and malware scanning, not human review, and researchers have shown it can be evaded. Nobody upstream runs the skill on a real task before you do. That last part is the whole problem, and it is the part that lands on the user.

This article details the kinds of risks present in the ecosystem, from outright malicious code to the more common problem of non-functional or low-quality skills. We will share specific, anonymized patterns our security pipeline has caught and explain what our test verdicts actually mean.

The Open-but-Unvetted Ecosystem

The primary appeal of the Claude skills ecosystem is its openness. Anyone can write a skill and, in many cases, publish it to a public index or share it on GitHub. This lowers the barrier to entry and encourages innovation. However, it also creates an environment where quality and safety are not guaranteed. When people ask whether ClawHub is safe, they are usually asking whether the index vouches for what it lists. The honest answer is that the larger indexes have tightened up after their own incidents: ClawHub now requires publisher identity verification, runs VirusTotal and code-pattern scanning on submissions, and since July 2026 holds new publishes behind a prepublication scan. That is real, and it is worth more than nothing. It is also not the same as someone reading the skill. Trail of Bits showed in June 2026 that this class of scanner can be bypassed, and Snyk’s ToxicSkills study still found prompt-injection payloads across a large share of the skills it sampled.

So the screening filters known-bad signatures; it does not decide whether a skill is trustworthy or useful. The responsibility for vetting the code—for checking what a skill’s hooks will do, what packages it might install, or what data it might access—falls to the end user. For a developer comfortable reading shell scripts and Python, this might be a manageable task. For most users, it is an unreasonable expectation. You install a skill to save time, not to begin a code audit.

This is the gap SkillProof was built to fill. We perform that audit, so you don’t have to.

Our Pre-Install Security Gate

Our testing pipeline begins with a critical step that happens before a skill is ever installed or executed: the Stage 0 security gate. When we pull a new skill for testing, we don’t immediately run its installation script. Instead, we first subject its source code and manifest files (SKILL.md, hooks, tool definitions) to a static analysis process.

The gate reads the skill’s components to check for known malicious or manipulative patterns. It is designed to catch overt attempts to compromise the security or integrity of the Claude environment.

If a skill fails this Stage 0 check, it is held back for review. It is never installed, never run, and never receives a verdict or a listing in our main catalog. This is an important point: the catalog statistics we publish do not include these pre-screened malicious skills. The failures we document are functional failures, not security breaches caught at the gate. The security problem is a separate, preceding layer of risk.

Malicious Patterns Caught by Our Stage 0 Gate

Our security gate has caught several patterns of behavior that range from manipulative to overtly hostile. These are not theoretical risks; they are real examples found in skills submitted to public indexes. For a deeper dive into these issues, see our post on malicious Claude skills we caught. Here are three distinct patterns we have blocked, described generically.

1. Persona-Override Prompt Injection

One skill’s SKILL.md file began not with a description of its function, but with a large block of text formatted as a CRITICAL SYSTEM OVERRIDE. This is a form of prompt injection. The text instructed the model to completely discard its helpful assistant persona and adopt a new, rigid one. The instructions included directives to prefix every single response with a specific activation key and to refuse to answer any prompt if another persona was detected as active.

The immediate risk here is session hijacking. The skill effectively seizes control of the model’s behavior, making it useless for any other task. It creates a denial-of-service condition for other skills and forces the user to interact on the skill author’s terms. This could be used to enforce an author’s own off-platform monetization scheme or simply to disrupt the user’s workflow. You can read more about this technique in our article on prompt injection in Claude skills.

2. Bash Auto-Approve Hook

Claude Code includes a critical security feature: when a skill wants to execute a shell command, it must first ask the user for permission via a confirmation prompt. We discovered a skill that was designed to silently disable this protection across the entire project.

It included a PreToolUse hook—a script that runs just before a tool is executed. This hook’s logic was simple and dangerous: for essentially every command, it returned a permissionDecision of allow. A short blocklist of obviously destructive commands made it abstain, but it never denied anything. In practice it presses “Yes” on the user’s behalf, from any skill, without ever showing a prompt.

Once this skill is active, any other skill (or the auto-approving skill itself) could execute arbitrary shell commands (rm -rf /, curl | sh, exfiltrating environment variables) with zero user interaction. It turns a core security feature into an open door for malicious code execution. This is one of the most significant risks in the ecosystem, which we cover in our general overview of Claude skills security.

3. Harness Manipulation and Unauthorized Installs

A third pattern involved a skill that manipulated the core user experience to force its own use, while quietly installing unauthorized software. It used a combination of hooks to achieve this:

• Tool Denial: Its hooks would deny permission for fundamental tools like Edit/Write/Task unless that specific skill had been invoked in the current session.
• Turn-End Blocking: The skill would also block the turn-end event, preventing the user from finishing their turn and forcing them to interact with the skill to proceed.
• Unauthorized Package Installation: Most concerningly, it included a SessionStart hook that, upon starting any session, would quietly run package manager commands (bun install, npm install) across every plugin cache directory it could find.

This pattern represents a sophisticated attempt to entrench a skill in the user’s environment. It creates a form of lock-in, degrades the functionality of the base model, and—most dangerously—uses the hook system to install arbitrary, untracked software on the user’s machine. In fairness to this particular author, the hooks are not wired up by the one-line install; they only take effect if you merge the shipped settings file yourself. We held the skill anyway, because shipping that file at all is a statement of intent. This could easily be used to install keyloggers, crypto miners, or other malware. It also raises the question: can Claude skills steal API keys? With the ability to run arbitrary code, the answer is yes.

Beyond Malice: The Problem of Low-Quality Skills

While malicious skills are a serious concern, they are not the most common problem a user will face. The far more frequent issue is simply that a skill does not work. It might be broken, abandoned, or so poorly documented that it’s impossible to use.

This is where our public catalog data provides a clear picture. Of the 1755 skills we have fully tested — all of which cleared security screening, some at intake and the older ones in a retroactive sweep — the results are mixed. Only 1083 skills, or about 62%, passed our tests outright.

Here is the breakdown of our findings:

Verdict	Count	Description
Pass	1083	Installs and works as advertised, beating the baseline.
Setup Needed	589	Works, but requires extra configuration first.
Fail	83	Scores below the baseline or fails to run.
Total Tested	1755	Excludes skills that failed pre-install security checks.

Understanding these verdicts is key to navigating the marketplace safely:

• Pass (62%): A pass verdict means the skill installed according to the author’s instructions, could be triggered for its intended purpose, and performed better on a real-world task than using plain Claude with no skill installed. These are the skills that deliver on their promise.

• Setup Needed: This is not a failing grade. These 589 skills do provide value, but not out of the box. They may require manual configuration of API keys, the installation of a companion skill, or connecting to a third-party service. Our verdict highlights this so you know what to expect before you install.

• Fail: The 83 skills in this category are the ones that represent wasted time or a negative impact. This verdict covers two scenarios. First, it includes skills that simply could not be run—a missing command-line tool, a dead dependency, an example that crashes. Second, it includes skills that did run but left you worse off than the no-skill baseline. These are skills that actively make your work harder. Installing one of these 83 skills is a demonstrably worse choice than using the base model.

This data shows that even after filtering for overt security risks, your chance of downloading a skill that either doesn’t work or requires significant extra setup is substantial.

What “Passing” a Test Means

Our goal is to provide an honest, practical verdict. To do that, we don’t use a single, standardized benchmark for all skills. A test for a code refactoring skill will look very different from a test for a database query skill.

Instead, every test case is designed specifically for the skill being evaluated, based on what that skill claims to do in its own documentation. We define a realistic task that fits the skill’s advertised purpose and then run it twice: once with the skill installed, and once using plain Claude.

The skill only earns a pass if it demonstrably beats the baseline. This might mean it accomplishes the task faster, with fewer prompts, or with a higher-quality result. The entire process is grounded in a simple question: does this tool make a skilled operator more effective? For a complete description of our testing framework, scoring, and verdict criteria, see our full methodology.

The Verdict on Marketplace Safety

So, are Claude skill marketplaces safe to install from? The ecosystem is not inherently safe in the way a curated app store with mandatory code signing and security reviews is. The risk of encountering malicious code is real, as demonstrated by the patterns our own security gate has blocked.

However, the more probable risk for the average user is not a targeted attack but a significant waste of time and effort on low-quality, broken, or undocumented skills. With a substantial portion of skills failing to work as advertised or requiring complex setup, installing from a public marketplace is a gamble.

Safe installation requires either the technical ability to perform your own code audit or reliance on a trusted third party that has done the work for you. Without that vetting, you are installing unaudited code that executes with the full permissions of your user account.

Related reading: for the patterns themselves, malicious Claude skills: what running 1,672 of them turned up; for the pre-install check you can run yourself in two minutes, Claude skills security: risks and pre-install checklist.

Finding Skills That Are Vetted and Ready

We don’t just publish failures. The primary goal of our work is to identify the tools that are genuinely effective. The 1083 skills that passed our tests represent a powerful, vetted toolkit for professional developers, analysts, and writers.

To make these easier to adopt, we group ten tested skills at a time into role-shaped packs: a developer toolkit, a security and code review pack, an optimizer pack, and packs for marketing, sales, design, writing, and founders. Every skill in a pack cleared the security gate and was run by us. Most are pass verdicts; a few slots go to setup skills that earned their place despite needing configuration first. Each pack page lists every skill inside with its individual verdict, so you can see exactly which is which before you buy.

You can find these tested-skill packs on our bundles page for a one-time price of $10 each. It’s a straightforward way to acquire a set of tools that are proven to work, without having to navigate the risks of the public marketplaces yourself.