Inspect the instructions
Check whether the skill’s stated purpose matches its instructions and whether it tries to manipulate the agent’s priorities.
Claude Code skills
Claude Code skill security
Third-party Claude Code skills can influence agent behavior and may include supporting scripts or external integrations. Review the full skill package before installing it in a trusted workspace.
Scan a Claude Code skillTrace execution paths
Review scripts, package installs, download steps, and commands that could change the local environment.
Limit trust by default
Do not grant credentials or broad permissions until you have reviewed evidence and understand the consequences.
A repeatable review workflow
Provide the public repository URL or upload the skill package, review the scan findings in context, then make an installation decision based on the specific behaviors detected—not a generic trust score alone.