Charlie HillsFree guide · Claude & Claude Code
Check a Claude skill before you install it
The 2-minute red-flag check, NVIDIA's free SkillSpector scanner (install, scan, read the score, plug it into Claude Code), Cloudflare's free deep audit, a paste-ready Claude review prompt, and what to do when a skill gets flagged.
Charlie Hills Added 11 November 2026 · Free
What’s inside
- 11. Why this matters
- 22. The 2-minute check (no installs)
- 33. Scan it with SkillSpector (free, from NVIDIA)
- 44. Run a deep audit with Cloudflare's skill (free)
- 55. Ask Claude for a second opinion (no installs)
- 66. Got a flag? What to do
- 77. The checklist
1. Why this matters
- Researchers checked 31,132 public skills. 26.1% had at least one security hole. 5.2% looked deliberately malicious. (Source: NVIDIA's SkillSpector research.)
- I scanned 151 skills from 12 popular repos with SkillSpector. 104 came back safe, 18 got a caution and 29 got flagged.
- I opened one flag, in Anthropic's own skill-creator. It was harmless: it copies your settings so it can run Claude. A flag means read it, not panic.
2. The 2-minute check (no installs)
Do this before any install. Open the skill's GitHub page and look for these.
|
Look at |
Fine |
Red flag |
|
Who made it |
A known company or a person with a real history |
A new account with one repo and no history |
|
|
Plain instructions that match the description |
"Ignore previous instructions", hidden text, or steps that have nothing to do with what it says it does |
|
Scripts folder |
Short scripts you can read |
Long scrambled text (base64), or code that downloads more code ( |
|
What it reads |
Files in your project |
|
|
Where it sends data |
Nowhere, or the one service it is built for |
An unknown web address, a webhook, or a paste site |
|
Activity |
Recent updates and open issues that get answers |
Stars but no issues, or a big change pushed just before it went viral |
That’s the first part. The rest of this guide is free too.
