← skillsmith scanner · all guides

Guides: Claude Agent Skill Security

Practical security guides for people who install AI agent skills.

Agent skills are just Markdown — which makes them easy to write, easy to share, and easy to abuse. These guides explain how malicious SKILL.md attacks work and how to defend against them in minutes, not hours.

• Prompt Injection in Claude Agent Skills: How It Works
  Data exfiltration, credential harvesting, paraphrased overrides — the words-as-malware problem explained.
• Anatomy of a Malicious SKILL.md
  A real-world-style attack skill dissected section by section, with the detection signal for each part.
• The SKILL.md Security Checklist
  Five-minute manual audit: author reputation, task/access mismatch, override language, data flow.
• Writing a Safe SKILL.md (Authors)
  Author checklist: honest frontmatter, scoped instructions, minimal deps, publish & monitor.
• Rug Pulls: When a Vetted Skill Turns
  Post-install monitoring: pin, baseline-hash, watch, re-check - with automatic Discord/Slack alerts.
• Dependency Risk in Agent Skills (OSV)
  Supply-chain review for SKILL.md: installs, pins, implied trust - checked against OSV vulnerability data.
• Homoglyph Attacks on Agent Skills
  Invisible Unicode look-alikes: typosquatting, allowlist evasion, and how detection catches them.
• Threat Modeling for AI Agent Skills
  STRIDE adapted to SKILL.md files: trust boundaries, attack categories, response playbook.
• FAQ — pricing, privacy, limits
  Short answers: what a clean verdict does and does not mean, how the sandbox works, data handling.
• How skillsmith Detects Malicious Skills
  Our detection methodology, scoring model, OSV integration — and honest limitations.

Scan a skill now

All guides apply the moment you install someone else's skill. Check yours in seconds with the free static scanner or go deeper with the behavioral sandbox.