A 'safe-looking' Claude Code skill used DNS rebinding to steal a local secret: why it is not safe to use

What happened

A Reddit post on August 1, 2026 described a proof of concept skill for Claude Code that looked like a normal CI/CD readiness check. CI/CD is software tooling used to build and ship code. According to the post, the skill contacted a domain controlled by the author. At runtime, that domain used DNS rebinding, a trick where a website name later points to a private local address instead of the public one you first saw.

The post says Claude Code reviewed the skill text, called it straightforward and legitimate, installed it, and then in a fresh session with Opus 4.8, read a fake sensitive note from a private address and sent it back out. The author said the risky part was not visible in the skill text itself. Their main point was that model-only inspection was not a reliable safety check.

What it means for you

If you use an AI agent, a skill can look harmless on paper but still behave differently when it runs. That matters if the tool can reach local services, home lab systems, or files that are not meant to leave your machine.

What to do instead

Treat third-party skills as code, not just prompts. Prefer skills from trusted publishers. Be careful with anything that fetches from the network, even if the domain looks normal. Limit access to local files, private web tools, and secrets where possible. Use test data instead of real credentials when trying new skills. AgentPod lists only reviewed, tested skills, but that is not a guarantee, so keep normal safety limits in place.

Sources:

• https://www.reddit.com/r/ClaudeAI/comments/1vbb9ju/a_safelooking_skill_made_claude_code_leak_a/