Use This SkillA malicious agent skill can do anything your agent is allowed to do: read files in your project, run shell commands under your user account, change code, and send what it finds to an outside server. In Claude Code, it can also pre-approve its own shell commands: 128 of the 1,959 public skills we read on November 8, 2026 do so for any command.
That last number is not a count of bad skills. It is a count of skills that ask for the widest permission a skill can give itself, which is the setting a bad one would need. When we read every flagged skill in our directory by hand on October 26, 2026, none was trying to harm the user (how we checked).
How much power do real skills give themselves?
We read the SKILL.md and every file in each skill folder of our directory on November 8, 2026: 1,959 skills from 47 GitHub repositories, the same set as the November 2 crawl. One repository with 100 skills asked for a sign-in and could not be read.
| What the skill does | Skills | Repositories | Why it matters |
|---|---|---|---|
Lists any allowed-tools in its front matter |
228 | 9 | Claude Code runs those tools without asking, for that turn |
Includes Bash in allowed-tools |
215 | 9 | Shell commands can run without a prompt |
Allows Bash with no command limit |
128 | 3 | Any shell command can run without a prompt |
| Ships script files (.sh, .py, .js, .ts and similar) | 215 | 20 | Code that the agent may run; 1,350 script files in all |
Ships scripts and allows Bash |
81 | 3 | Scripts that can run without a prompt |
Runs !`command` lines when it loads |
67 | 1 | Commands run before Claude reads the skill |
Source: Use This Skill directory, read by script on November 8, 2026. Of the 128 skills that allow any shell command, 95 are in K-Dense-AI/claude-scientific-skills, 31 in trailofbits/skills and 2 in browser-use/browser-use. All 67 skills with load-time commands are in Donchitos/Claude-Code-Game-Studios; they read the project's own settings and git history, and every one of them also lists Bash in allowed-tools.
These are well-known repositories, and broad shell access is normal for skills that run analysis or build tools. The point is where the risk sits: the same front matter line that lets a helpful skill work without interruptions would let a harmful one work without interruptions too. You can see each skill's scan result on its page in the directory.
What can a skill do without asking you?
In Claude Code's default mode, its permissions documentation says file reads inside your working directory need no approval, while shell commands (apart from a built-in set of read-only ones), file edits and most web requests do. A skill changes that in two ways.
It can pre-approve tools. Claude Code's skills documentation says allowed-tools lets Claude use the listed tools "without prompting you for approval" during the turn that invokes the skill. It does not remove other tools, and your own deny and ask rules still win. The documentation adds a warning worth reading in full: workspace trust does not gate this field, so a project skill's allowed-tools applies even in a folder you have never trusted, and "a skill can grant itself broad tool access."
It can run commands before the model sees it. A line like !`git log` in SKILL.md runs when the skill loads, and Claude receives only the output. The documentation says these commands "never prompt for permission"; each is checked against your permission rules and the skill's own allowed-tools, and outside auto mode, any command that is not allowed stops the skill from loading. So a skill that pre-approves the commands it injects can run them with no prompt at all.
Everything else a skill does, it does by asking the model to act. The model may refuse, and you may be asked to approve, but you are approving a step written by a stranger.
What has a malicious skill actually done?
The largest documented case was on ClawHub, an open marketplace for OpenClaw skills. On February 2, 2026, The Hacker News reported that Koi Security found 341 malicious skills among 2,857 it audited. The skills looked useful and included a "Prerequisites" section telling the user to install something first: a password-protected zip on Windows that held a keylogging trojan, and on macOS a script to paste into Terminal that led to the Atomic Stealer malware. According to OpenSourceMalware, cited in the same report, the campaign went after exchange API keys, wallet private keys, SSH credentials and browser passwords.
Datadog Security Labs showed a quieter route on May 11, 2026. Its example skill tried to read a GitHub token with gh auth token and send it to a remote server. One model refused the plain version; in the version where the theft ran through !`command` lines, the commands ran during loading, before the model could object.
Which patterns would a harmful skill use?
Our weekly scan looks for nine patterns that a harmful skill would need and an ordinary skill rarely does. Here is how many skills matched each in the November 2 scan of 2,060 skills.
| What a harmful skill would try | Scan rule | Level | Skills matched |
|---|---|---|---|
| Download and run code in one step | fetch-exec | flag | 14 |
| Delete files across the system or home folder | destructive | flag | 2 |
| Send data to an outside address | exfil | flag | 1 |
| Hide code by encoding it, then run it | obfuscation | flag | 0 |
| Read credential files or secrets | credentials | review | 34 |
| Ask for administrator rights or loosen permissions | privilege | review | 32 |
| Tell the agent to ignore its rules | override | review | 5 |
| Install something that runs later | persistence | review | 4 |
| Rewrite shared git history | force-push | review | 2 |
Source: Use This Skill weekly scan, November 2, 2026 (1,987 clear, 58 review, 15 flagged). A skill can match more than one rule. The exact patterns are on how the safety scan works.
Most matches are harmless: an official installer piped into a shell, or a security skill quoting the pattern as a warning. A pattern match tells you which line to read, not what the author meant.
How do I limit what a skill can do?
- Read SKILL.md before you install it. Look at the front matter first:
allowed-tools, and any line starting with!`. - Read every script in the folder. Check what each one reads and where it sends it.
- Look inside
.claude/skills/before opening a cloned repository with Claude Code, since project skills there load when you start it. - Keep deny rules for what matters. Deny and ask rules still override a skill's
allowed-tools. - Turn off load-time commands if you do not use them. Set
"disableSkillShellExecution": true; teams can set it in managed settings. - Scan before you install. Paste a GitHub link into the free skill check, have a connected agent call check_skill, or scan your own repository in CI.
Codex, Cursor and Gemini CLI read the same SKILL.md format but apply their own approval and sandbox settings; the allowed-tools and !`command` behavior above is Claude Code's. Our guide to skills in Codex, Cursor and Gemini CLI covers what each agent reads.
How we counted
On November 8, 2026 we cloned each repository in the November 2 crawl (data/skills.json: 2,060 skills, 48 repositories) and read each skill folder by script. 1,959 skills from 47 repositories could be read; Shaisolaris/solaris-dev-shop (100 skills) asked for a sign-in, and one listed path in stablyai/orca had no SKILL.md. "Allows Bash with no command limit" means the allowed-tools value names Bash alone or Bash(*), not a pattern such as Bash(git *). Script files are counted by extension anywhere in the skill folder. Load-time commands are lines matching Claude Code's !`command` form. Claude Code behavior is from its skills and permissions documentation, read on November 8, 2026.