← skillsmith scanner · all guides
Security people run threat models before trusting a system. You can apply the same discipline to Claude Agent Skills in about ten minutes. This guide walks the four classic questions — what are we building, what can go wrong, what would an attacker do, how do we respond — translated to SKILL.md files.
An agent skill is a configuration that becomes instructions. Map every input:
Each of these is a trust boundary you accept when you install.
| Category | Skill-flavoured example |
|---|---|
| Spoofing | Skill impersonates a popular one (typosquat name, homoglyphs) |
| Tampering | Rug pull: remote content changes after you vetted it |
| Repudiation | "Do not tell the user" steps hide what happened |
| Information disclosure | Credentials/env collected "for context" and forwarded outward |
| Denial of service | Instructions that make the agent loop or spam endpoints |
| Elevation of privilege | Override language ("set aside earlier guidance") hijacks the operator's rules |
The cheapest attacks win: rename a known-malicious skill, paraphrase its injection lines so keyword filters pass, split a base64 payload into harmless chunks, defang the exfiltration URL until runtime. Detection therefore has to work at the meaning level — exactly why prompt injection mechanics matter more than blocklists.
POST /api/watch) and check near-duplicates
(/api/similar) against known-bad variants.A skill converts text into authority over your agent. Threat model it like code from a stranger: minimize what it can touch, verify what it claims, monitor it after install, and never let it instruct the agent to hide things from you.