The SKILL.md Security Checklist

Guide · skillsmith.ch

Before you install a third-party Claude Agent Skill, run through this checklist. It takes five minutes and covers the attack patterns that matter. Steps 1–4 you do by reading; step 5 you automate with skillsmith.

1. Who wrote it, and can they rug-pull it?

Is there a source repository with commit history — or just a pasted file?
Does the repo have issues, forks, or any second reader?
If the skill loads resources from a URL: that URL's content can change after you vetted it. Pin versions; re-check periodically.

2. Does the stated purpose match the requested access?

A summarizer does not need ~/.ssh. A formatter does not need network access. Read every line that touches:

Touchpoint	Acceptable for…
`~/.ssh`, `.env`, keychains, API keys	almost never in a skill
Network calls (webhooks, APIs)	skills whose job is integration/communication
Writing outside the project directory	rarely; ask why
Installing packages or running scripts	only with a very good reason

3. Look for override language

Search the file for imperatives aimed at the agent rather than describing tasks: "ignore", "override", "instead of", "set aside", "forget", "new rules", "do not tell", "hide", "invisible". Any hit deserves an explanation — and most cannot be explained innocently.

4. Check where data goes

List every URL in the file. Ask for each: does the skill's purpose require this endpoint? Watch for defanged forms (hxxps://, example[.]com) and base64 blobs near words like run, execute, decode, payload.

5. Automate what you just did by hand

The checklist above is exactly what skillsmith automates:

Static scan: prompt-injection patterns (including paraphrases), exfiltration endpoints, dropper chains, homoglyph tricks, known-vulnerable dependency pins via OSV.dev → scanner
Behavioral sandbox: an AI analyst simulates what an agent following the skill would do, step by step, with IOCs and a severity verdict → behavioral analysis
Rug-pull watch: hash a GitHub-hosted skill today, re-check tomorrow — if the content changed after you approved it, you want to know → POST /api/watch (API docs)
Near-duplicate search: find renamed/cosmetically altered variants of a known-bad skill via Skill-DNA → API docs

The one-line version

A skill is code that talks you into running it. Review it like code, not like documentation.