Check if your Claude skills are actually safe
Researchers checked 31,132 AI agent skills. 1 in 4 had at least one security hole. About 1 in 20 looked like it was made to harm you on purpose. Anthropic's own docs say to use skills only from trusted sources. So here are the two prompts from my reel. One checks the skills you already have, and one checks a skill before you install it. My skill safety checklist is below them. All of it is completely for free.
Both prompts and my checklist
Copy each one with its button. They work in Claude Code and in Codex.
- 1
Prompt 1: check the skills you already have
Open a fresh Claude Code or Codex session and paste this. It will go through every skill on your computer and tell you which ones you need to delete now.
From my reel: the real arXiv page of the study. I marked the 5.2% line and added the big number. PromptCheck every skill on my computer like a security expert. Does it send anything to the internet or touch files it doesn't need to? And provide me a report on which skills I need to delete now.
- 2
Prompt 2: check a skill before you install it
Before you install any new skill, paste this first. Then paste the link of the skill you are installing, and read what it finds before you say yes.
From my reel: a made-up skill folder. SKILL.md has the instructions. The scripts folder has code files, and those need extra care. PromptCheck this like a security expert. Does it send anything to the internet or touch files it doesn't need to? [paste the link of the skill you are installing]
- 3
My skill safety checklist
Go through these 5 checks before you install any skill. Copy them and keep them somewhere you will see them.
In the study, skills with code files inside were 2.12 times more likely to have a security hole than skills with only instructions.
From my reel: Anthropic's own Agent Skills docs. The line I marked says to use skills only from trusted sources. PromptMy skill safety checklist [ ] It comes from Anthropic or from someone I trust. [ ] I opened its SKILL.md file and read what it tells the AI to do. Every skill has one. [ ] I checked if it has code files inside, like .py or .sh files. If it does, I am extra careful. [ ] I ran prompt 2 on it. It does not send anything to the internet or touch files it doesn't need to. [ ] I am careful with bypass permissions in Claude Code and full access in Codex. A skill has the same internet access as any other program on my computer.
How to check your skills
- 1
Open a fresh session
Open a new Claude Code or Codex session. In the Claude desktop app, switch to Code, or open Claude Code in your terminal.
- 2
Paste prompt 1
It will check every skill on your computer and give you a report on which ones to delete now.
- 3
Delete what it flags
Read the report. For the skills it flags, just say "delete these skills for me".
- 4
Check every new skill first
Before you install any new skill, paste prompt 2 and the link of the skill. Only install it if it comes from someone you trust and the check comes back clean.
Questions people ask
Are Claude skills safe?
Not all of them. In a study called "Agent Skills in the Wild" (January 2026), researchers checked 31,132 agent skills. 26.1% had at least one security hole. 13.3% had patterns that could leak your data. And 5.2% had high-severity patterns that strongly suggest someone made them to do harm. Read the study
What does Anthropic say about skills?
Anthropic's own docs say to use skills only from trusted sources: ones you made yourself or got from Anthropic. They also say that in Claude Code, a skill has the same network access as any other program on your computer. Read Anthropic's docs
Which skills should I be extra careful with?
The ones with code files inside. Every skill has a SKILL.md file with its instructions. Some also carry scripts, like .py or .sh files. In the study, those were 2.12 times more likely to have a security hole.
Do I need to know how to code?
No. You paste the prompt, and Claude or Codex reads the skill for you and explains it in plain English. I do not write code myself.
Want AI set up like this for your business?We build AI setups and run ads for businesses.
Talk to usThe numbers come from "Agent Skills in the Wild" (arXiv 2601.10338, 15 Jan 2026). The trusted sources rule comes from Anthropic's Agent Skills docs. All credit to the researchers and to Anthropic.