Anthropic Skills: why it is not safe to use
Our review found no security or privacy issues in the inspected Anthropic Skills repository materials.
What we found
Our review of the inspected `anthropics/skills` repository materials did not identify a security or privacy issue that would prevent approval. The repository passed our checks with a score of 92/100. In the sampled files, we found visible and ordinary skill instructions in `SKILL.md`, with no hidden or disguised prompts. We did not find hardcoded credentials, API keys, or tokens. The inspected examples focused on local, user-requested file and document processing, and we did not see evidence of sending data to undisclosed third parties, fetching remote code at runtime, or accessing unrelated credentials such as environment variables, browser stores, SSH keys, or keychains. We also did not find signs of obfuscation, privilege escalation, sandbox escape behavior, or dangerous commands such as irreversible deletion or overwrite without confirmation.
What to do instead
This skill passed our review, so no security workaround is needed based on the inspected materials. As a normal precaution, review the specific skill files you plan to use, confirm what data you provide to any file-processing workflow, and test changes in a limited environment before broader use.
Source: https://github.com/anthropics/skills
We report what our security review found at the time we checked, with the goal of keeping people safe. Projects change; if a maintainer has since fixed this, we are glad to recheck it. Email hello@agentpod.com.