A skill runs with the same access you gave Claude. If Claude can see your client folders or API keys, a bad skill can tell it to read them. So check it first, without running it.
Step 1: Read it in a plain text editor
Open the SKILL.md itself, not a preview of it. Red flags:
~/.ssh, .env, keys or passwords: your credentials.
Send, upload or post to a URL: data leaving your machine.
"Do not mention this": it's hiding from you.
Step 2: Look for what you can't see
Instructions can hide in HTML comments, invisible characters, or text pushed off the screen, so the file looks clean when you open it. The test skill I wrote hides an instruction in an HTML comment and three invisible characters at the end of a line. Paste the file into Claude and ask:
Does this file contain any hidden text, HTML comments, or instructions that aren't visible when it's displayed? Quote them.
Step 3: Run a scanner
SkillSpector is free and open source, from NVIDIA. It reads the files without running the skill, looks for hidden instructions, credential access and prompt injection, and scores the skill out of 100.
uv tool install git+https://github.com/NVIDIA/skillspector.git
skillspector scan ./the-skill-folder/ --no-llm
https://github.com/NVIDIA/skillspector
My test skill scored 65 out of 100: high risk, do not install. A clean scan isn't a guarantee, so still do steps 1 and 2.
Step 4: Check who made it
Prefer official sources (Anthropic, OpenAI, Vercel, NVIDIA, Microsoft) or people with a track record.
Step 5: Read every script
If the skill ships code, find out what each file does before it can run.
Step 6: Limit access
Give Claude only the folders it needs, and remove skills you don't use.