Skills DirectorySeptember 2026
We Scanned 103,619 Claude Skills for Security Issues. Here's What We Found.
Last updated: September 2026
Claude skills are markdown files that tell an AI agent what to do. When you install one, its instructions run with whatever access your agent has: your shell, your filesystem, your environment variables, your gh auth token.
That makes skills a supply chain. And until recently, nobody was scanning it at scale. Snyk's ToxicSkills research audited 3,984 skills from ClawHub in February 2026 and found confirmed malicious payloads in the wild. We run Skills Directory, which indexes skills from public GitHub repos — so we scanned everything we have: 103,619 skills from 5,316 repositories (as of August 31, 2026), every one through the same static analyzer — 36 rules, 120 detection patterns — that powers the security grades on our site.
This is what the ecosystem looks like from the inside.
TL;DR
- 86.2% of skills are completely clean — zero findings of any severity.
- 3,919 skills (3.8%) have at least one critical finding: piping remote scripts into a shell, sending environment variables to external URLs, reading SSH keys, or injecting prompts.
- 293 skills contain prompt-injection patterns — including 128 with a literal "ignore previous instructions" and 159 that impersonate system messages.
- GitHub stars tell you nothing about safety. The A/B-grade rate is essentially flat from 0-star repos (97.8%) to 1,000+-star repos (98.9%).
- The ecosystem is heavily concentrated and copied: the top 20 repos account for 30.6% of all skills, and we found 816 clusters of byte-identical skills published under different names.
Methodology (and its limits, up front)
Every skill's SKILL.md (plus bundled files, where present) goes through 36 static-analysis rules (120 patterns) across eleven categories: execution, exfiltration, credentials, filesystem, network, persistence, supply-chain, obfuscation, prompt-injection, hidden-helpers, and known threats. Findings are severity-weighted into a 0–100 score, mapped to a grade:
| Grade | Score | Skills | Share |
|---|---|---|---|
| A | 90–100 | 98,482 | 95.0% |
| B | 75–89 | 3,394 | 3.3% |
| C | 60–74 | 967 | 0.9% |
| D | 40–59 | 465 | 0.4% |
| F | 0–39 | 311 | 0.3% |
Matches inside markdown code fences get reduced confidence (documentation quoting a dangerous command is not the same as instructing an agent to run one).
Three honest limitations:
- This is static analysis, not sandboxed execution. We detect capability, not intent. A skill that runs
curl https://bun.sh/install | bashis flagged critical because pipe-to-shell is the classic supply-chain primitive — even though installing Bun is what most users want it to do. - False negatives exist. Sufficiently obfuscated instructions, payloads fetched at runtime, and adversarial prose that reads as benign to a regex will get through. Snyk's core finding was exactly this: the paradigmatic malicious skill hides in natural language, not shell scripts.
- A grade is a first-pass filter, not an audit. An A means our rules found nothing. It is not a guarantee.
With that on the table, the data.
What the 13.8% with findings actually contains
14,343 skills triggered at least one rule. By category (a skill can appear in several):
| Category | Skills affected |
|---|---|
| Supply-chain | 10,435 |
| Network | 2,636 |
| Filesystem | 1,850 |
| Exfiltration | 1,444 |
| Execution | 1,175 |
| Persistence | 718 |
| Prompt-injection | 293 |
| Credentials | 264 |
| Obfuscation | 25 |
| Hidden helpers (e.g. password-protected archives) | 12 |
| Known threats (repos flagged in the ToxicSkills study) | 5 |
The single most common finding is mundane and important: 9,505 skills install packages at runtime (npm install, pip install, etc.). That's often legitimate — and it means the skill's real dependency tree is resolved at execution time, on your machine, outside anyone's scan.
The critical findings
The sharper end, by rule:
| Finding | Severity | Skills |
|---|---|---|
| Pipes output into a shell interpreter | critical | 1,172 |
| Downloads and executes remote scripts | critical | 1,168 |
| Sends env vars / credentials to an external URL | critical | 785 |
| Credential exfiltration via HTTP (ToxicSkills pattern) | critical | 768 |
| Accesses sensitive system/user directories | critical | 728 |
| Modifies startup scripts or services (persistence) | critical | 636 |
| Reads or references SSH private keys | critical | 186 |
| Impersonates system messages | critical | 159 |
| "Ignore previous instructions" | critical | 128 |
| Claims developer/debug mode to bypass safety | critical | 24 |
| Password-protected archives (scanner-evasion) | critical | 11 |
| Unicode smuggling of hidden instructions | critical | 2 |
Two things stand out when you read the actual matches.
First, most pipe-to-shell findings are installers. curl -fsSL https://bun.sh/install | bash and curl -LsSf https://astral.sh/uv/install.sh | sh appear constantly. These aren't attacks — but they are your agent executing an unpinned remote script as a side effect of "installing a skill," and you should get to see that before it happens. That's the point of flagging capability.
Second, the credential patterns are less innocent. We found skills that interpolate $(gh auth token) into commands, read ~/.config/fly/token with an environment-variable fallback, and grep startup logs for tokens. Some of these are deploy workflows doing their jobs. Some have no business doing what they do given what their descriptions claim. Static analysis can't tell you which — which is exactly why a flag saying "this skill reads your GitHub token" belongs next to the install button.
The prompt-injection numbers deserve their own line: 128 skills contain a literal "ignore previous instructions," 159 impersonate [SYSTEM] messages, and 24 invoke a fake "developer mode." There is no legitimate reason for an installable skill to do any of those. In Snyk's study, 91% of confirmed-malicious skills employed prompt-injection techniques alongside their payloads — making this category the closest thing the dataset has to a smoking-gun signal.
Stars are not a security signal
The most counterintuitive result. We bucketed skills by their repo's GitHub stars:
| Repo stars | Skills | A/B grade | D/F grade |
|---|---|---|---|
| 0–9 | 31,544 | 97.8% | 1.0% |
| 10–99 | 39,700 | 98.4% | 0.6% |
| 100–999 | 23,379 | 98.7% | 0.6% |
| 1,000+ | 8,996 | 98.9% | 0.6% |
A 1,000-star repo is barely safer than a 0-star one. Popularity measures distribution, not review — and distribution is what an attacker wants. "It has lots of stars" is not a threat model.
The ecosystem copies itself
Two structural facts that surprised us:
- Concentration: the top 20 repositories account for 31,732 skills — 30.6% of everything. The largest single repo contains 10,104 skills. A huge share of "the skill ecosystem" is a small number of mega-compilations republishing other people's work.
- Duplication: even after our canonical-detection already deduplicates aggressively, we found 816 clusters of byte-identical skill content still published under different names and repos — 1,402 redundant copies, with one skill republished 45 times.
Why this matters for security: compilations copy fast and review never. If a popular skill is ever backdoored, the compilation layer becomes the distribution network. It also means "20,000 curated skills" and "100,000 indexed skills" describe the same underlying ecosystem more than the numbers suggest — the unique-content count is what's real.
What you should actually do
If you install skills — from anywhere, including us:
- Read the SKILL.md before installing. It's markdown. It takes two minutes. Look for network calls, credential reads, and anything addressing "the system."
- Treat installers as a decision. A skill that curls a script into bash is making a supply-chain choice on your behalf. Pin versions where you can.
- Don't use stars as a proxy for safety. See above.
- Prefer skills where you can see a scan. Every skill on Skills Directory shows its grade, score, and the specific findings with line numbers — the methodology is public. If you maintain a skill, your grade badge is free to embed.
The uncomfortable truth of this dataset is that the agent-skills ecosystem is mostly fine, structurally fragile, and completely unaudited by default. 96% of skills graded A or B. But 3,919 of them can read your credentials, and the only thing standing between "capability" and "incident" is whether anyone looked.
We looked at 103,619 of them. We'll keep looking.
Grade data for every skill is available via our public API. If you're a researcher and want the aggregate dataset behind this post, email us — we'll share it.