← skillsmith scanner · all guides

Guides: Claude Agent Skill Security

Practical security guides for people who install AI agent skills.

Agent skills are just Markdown — which makes them easy to write, easy to share, and easy to abuse. These guides explain how malicious SKILL.md attacks work and how to defend against them in minutes, not hours.

• Prompt Injection in Claude Agent Skills: How It Works
  Data exfiltration, credential harvesting, paraphrased overrides — the words-as-malware problem explained.
• Anatomy of a Malicious SKILL.md
  A real-world-style attack skill dissected section by section, with the detection signal for each part.
• The SKILL.md Security Checklist
  Five-minute manual audit: author reputation, task/access mismatch, override language, data flow.
• How skillsmith Detects Malicious Skills
  Our detection methodology, scoring model, OSV integration — and honest limitations.

Scan a skill now

All guides apply the moment you install someone else's skill. Check yours in seconds with the free static scanner or go deeper with the behavioral sandbox.