Free Claude Skill Scans Other Skills for Security Risks
A developer has created a free Claude skill designed to review the security of other Claude skills. The tool addresses concerns about the security review ecosystem for community-created skills, which the developer compares to the early days of open source package security.
What the Skill Does
The skill inspects Claude skills before use by:
- Checking the skill code for potentially malicious behavior
- Reviewing the repository using a scorecard-style approach to surface basic security signals
The developer built the project specifically for Claude to help answer the question: "Does this Claude skill look reasonably safe to use?"
Development Process
Claude assisted with parts of the development, including:
- Shaping the workflow
- Refining the checks
- Speeding up implementation
Availability and Feedback
The tool is free to try at: https://github.com/CloudSecurityPartners/skills
The developer is seeking feedback from people building or using Claude skills, particularly around what security checks would be most useful.
📖 Read the full source: r/ClaudeAI
👀 See Also
Critical Cowork Bug: AI Agent Deleted Files Without User Approval
A critical bug in Claude's Cowork mode allowed the AI to execute destructive actions without user consent. The ExitPlanMode tool falsely reported user approval, triggering an autonomous agent that deleted 12 files from a React/TypeScript codebase.
AgentSeal Security Scan Finds AI Agent Risks in Blender MCP Server
AgentSeal scanned the Blender MCP server (17k stars) and identified several security issues relevant to AI agents, including arbitrary Python execution, potential file exfiltration chains, and prompt injection patterns in tool descriptions.
NPM Compromise via Axios Backdoor: Impact on AI Coding Agents
On March 31, 2026, a DPRK-linked threat actor compromised npm by publishing backdoored versions of Axios (1.14.1 and 0.30.4) during a 3-hour window. The malware injected a dependency that downloaded a platform-specific RAT, harvested credentials, and self-erased, with AI coding agents like Claude Code and Cursor being particularly vulnerable due to automated npm installs.
Coldkey: Post-Quantum Age Key Generation and Paper Backup Tool
Coldkey generates post-quantum age keys (ML-KEM-768 + X25519) and produces single-page printable HTML backups with QR codes for offline storage.