Before you install a Claude Code skill, open its folder and look for a scripts/ directory. If the SKILL.md tells Claude to run a file from it, read that file, and read the skill's allowed-tools line too.
The reason is simple. A skill is more than instructions. In 979 of the 5,036 community skills we read from our directory, about one in five, the SKILL.md tells Claude to run a script that ships with the skill. That script runs on your machine with your permissions. And if the skill's allowed-tools lists Bash, Claude can run it, and any other shell command, without asking you during that turn.
Quick guess: how many of those scripts reach the network? 272 skills, about one in twenty. Many of them call the API the skill is about, and 93 of them also read an environment variable named like a secret, such as an API key.
Three checks before you install a skill
- Find the scripts the SKILL.md names, and search them. Look for
curl,requests,fetchandwget(network),rm -rfandshutil.rmtree(recursive deletes),pip installandnpm installrun from the script, and environment variables withKEY,TOKENorSECRETin the name. Each one is fine when it matches what the skill says it does. - Read
allowed-tools. The listed tools run without a permission prompt during the turn that invokes the skill.Bash(git status *)allows that one command. A bareBashallows any command. The docs also note that workspace trust does not gate this field, so a project skill applies it even in a folder you have never trusted. - Search the SKILL.md for
!`. A line like!`git diff HEAD`runs a shell command when the skill loads, before Claude reads the skill, and pastes the output in. It is a useful feature, and it is also code that runs before anyone looks at it.
How we tested
- Skills. All 5,082 community skills in our directory, the ones that passed our review. The directory's other 19 are Anthropic's official skills, which we left out. We could read 5,036; the rest were in deleted repos or could not be fetched. We also read the 317 skills our November review dropped, to compare.
- Files. One GitHub tree per repo, then the SKILL.md and its scripts from that same commit. A script is a
.py,.sh,.js,.ts,.mjs,.rb,.plor.ps1file in the skill's folder. We skipped folders that belong to another skill, plusnode_modules, tests, fixtures and build output. We went at most three levels deep. - Runs a bundled script. We count a skill here when its SKILL.md names one of those files. Everything we say about what scripts do is counted on these named scripts only.
- Reading. Pattern rules on the source with comments removed. Nothing was installed or run. We checked samples by hand and fixed four rules that over-counted, for example printed "pip install X" hints that never run.
Results
Out of 5,036 skills in the directory:
| What the skill does | Skills | Share |
|---|---|---|
| Ships script files | 1,175 | 23.3% |
| SKILL.md tells Claude to run one of them | 979 | 19.4% |
| The script writes or deletes files | 691 | 13.7% |
| The script starts other programs | 342 | 6.8% |
| The script goes online | 272 | 5.4% |
| The script goes online and writes files | 236 | 4.7% |
| The script deletes folders recursively | 122 | 2.4% |
| The script reads an environment variable named like a secret | 119 | 2.4% |
| The script reads a secret-named variable and goes online | 93 | 1.8% |
The script names a credential file (.env, ~/.ssh, ~/.aws/credentials) | 57 | 1.1% |
| The script installs packages itself | 43 | 0.9% |
The script uses sudo | 10 | 0.2% |
SKILL.md sets allowed-tools | 563 | 11.2% |
allowed-tools pre-approves Write or Edit | 249 | 4.9% |
allowed-tools pre-approves Bash for any command | 233 | 4.6% |
allowed-tools pre-approves Bash for listed commands only | 151 | 3.0% |
| Runs a bundled script and pre-approves Bash for any command | 50 | 1.0% |
SKILL.md runs a command on load with !` | 40 | 0.8% |
| SKILL.md registers hooks that last the whole session | 13 | 0.3% |
A few examples, without names:
- Network. A website audit skill fetches the live pages it scores. A graph database skill calls the vendor's REST API to create and run agents. Both go online because that is the job.
- Secrets. An SEO checklist skill loads its own API keys from
~/.config/<tool>/.env. That is why it names a.envfile. It is also the line to read, since the same code could read any file you can. - Deletes. A music video skill removes a project folder with
shutil.rmtree. Check what path a recursive delete gets. - Installs. A slide deck skill's PPTX export script runs
npm installinside the skill's own folder. - Bash for any command. An experiment loop skill pre-approves Read, Write, Edit, Bash and Agent, and runs its own tree script. Inside that turn, none of those tools asks you first.
- On load. A memory recall skill uses
!`to run a script from its plugin folder as soon as it loads.
Many of the 979 are ordinary: a scaffolder that creates the folders it needs, a deploy script that cleans up its temp folder. The point of the checks is to see that the script matches the skill.
What the dropped skills tell us
Our November review dropped 317 of the 783 new skills it read. We read those 317 the same way and matched each one to its published drop reason.
| Why the review dropped it | Skills | Runs a bundled script | Script goes online | Script writes files |
|---|---|---|---|---|
| Evades detection or platform rules | 35 | 48.6% | 20.0% | 42.9% |
| Unsafe | 41 | 39.0% | 14.6% | 29.3% |
| Paid API or ad funnel | 65 | 21.5% | 16.9% | 12.3% |
| Only useful to its author or one project | 46 | 13.0% | 6.5% | 10.9% |
| Placeholder, template, demo or test fixture | 108 | 6.5% | 0% | 0% |
| Kept in the directory | 5,036 | 19.4% | 5.4% | 13.7% |
Skills dropped as unsafe run a bundled script 2.0 times as often as the skills we kept (39.0% against 19.4%), and skills dropped for evading platform rules 2.5 times as often (48.6%). Their scripts go online 2.7 and 3.7 times as often (14.6% and 20.0% against 5.4%). Templates and demos almost never ship scripts, which pulls the dropped group's overall average down to 20.2%, close to the kept 19.4%.
So a script is a normal part of a skill. In the two groups the review dropped for safety and rule breaking, scripts show up 2 to 2.5 times as often as in the skills we kept, and those scripts go online 2.7 to 3.7 times as often. Those are the skills where reading the script pays off most.
What to ignore
The file count. A skill with forty helper scripts can be harmless, and a skill with one can send your keys somewhere. Read the scripts the SKILL.md actually names.
Limitations
- Static only. A named script may not run every time. Pattern rules miss calls built at runtime and can match a command inside a string. Network counts include some browser code that loads local files, and credential paths include security scanners that list those paths as patterns to block.
- One snapshot. Skills entered the directory over time. We read every script at its repo's current commit on November 6, 2026, so some authors have changed things since their skill was listed.
- Not cause and effect. The dropped skills are the ones our review flagged, not a random sample. The comparison shows which problems tend to come with scripts. It does not show that scripts get skills dropped.
- Capabilities, not intent. We did not judge whether any script misuses what it does.
Reproduce it
The counts above, for kept skills, dropped skills and each drop reason, are in skill-scripts-2026-11.json. Repo and skill names are left out. To check one skill yourself, open its folder, find the file names its SKILL.md mentions, and search them for the patterns in the first check above.
The skills we kept, with install commands, are in the AgentCraft skills directory: 5,101 Claude Code skills, and every community skill is reviewed before it's listed.
The full post is on AgentCraft: https://agentcraft.dev/en/blog/claude-code-skill-scripts-2026-11/
Disclosure: I'm Adrian Vale and I help run AgentCraft.
