Third-party Claude Code skills can run shell commands before you read them

A hands-on analysis published on dev.to details how much a third-party Claude Code skill can do before anyone opens the file: shell commands that execute without confirmation, hooks that run with full user permissions, and MCP servers the session connects to on its own. The findings land as skill registries already count installs in the millions — the top skill on Vercel's skills.sh reports three million — and users install them the way they install npm packages: by name and star count, without reading the contents. The author verified behaviour on Claude Code 2.1.223 rather than relying on secondhand accounts.

What a skill actually is

A skill is a folder containing a SKILL.md file, installable with a single command such as npx skills add owner/repo or /plugin install name@marketplace. The critical difference from an ordinary dependency, as the dev.to post frames it, is that a package runs inside your application while a skill runs as you, on your machine.

A skill has three layers. The frontmatter description sits in the context of every session while installed, and it is what the model uses to decide whether to pick the skill up unprompted; keeping it out of context requires explicitly setting disable-model-invocation: true, and of the 364 skills in the largest repository examined, not one did. The body loads on invocation and can contain embedded ! commands — according to the post, Claude Code runs these before the model ever sees the text, substituting the output in place. The allowed-tools field does not restrict but grants: listed tools run without a confirmation prompt for the invoking turn.

A plugin adds three more entry points: hooks defined in hooks. (shell scripts firing on session start, every tool call, and session end), MCP servers declared in .mcp., and a bin/ folder whose executables are added to the Bash tool's PATH. The documentation, cited in the post, states hooks execute shell commands with your full user permissions and that the sandbox covers Bash commands only — not hooks.

What the tests showed

The author ran four skills in an empty project using claude -p, the non-interactive mode used in CI where nobody is present to answer a prompt. A skill with allowed-tools: Bash(*) plus an embedded command wrote a marker file with no prompt. The same skill without allowed-tools was aborted. An instruction in the body asking the agent to run a command, combined with allowed-tools, also ran unprompted. Auto-invocation via the description did not trigger in that particular run — the model declined to pick the skill up — but the mechanism remained available with the description already in context.

What popular repositories ship

The post's repository survey found that non-malicious packages still carry significant surface area. A curated marketplace from a well-known audit firm contained 31 skills, all specifying allowed-tools, 24 of them with a bare unrestricted Bash entry. A 364-skill collection with 24,000 stars included five hooks. files — one receiving the output of every Bash command, another reading files from disk at session start — and three .mcp. files connecting an external HTTP server, a local process, and an npx-run script. Another marketplace's ten external plugins listed nine with only a URL and no sha or ref, meaning installation takes whatever is at HEAD at that moment.

The official Anthropic marketplace fared better on pinning — all 233 of its external GitHub plugins have a sha set — but auto-update is on by default, and the author observed an installed plugin update itself overnight without being asked.

Prior incidents and data routes

The risk is not theoretical. In February 2026, Koi Security checked OpenClaw's ClawHub registry and found 341 malicious skills out of 2,857, roughly 12 percent, with 335 from a single campaign. Snyk scanned 3,984 skills from ClawHub and skills.sh: 76 confirmed malicious, 13.4 percent with critical issues, and 10.9 percent carrying hard-coded secrets. The common pattern was a "prerequisites" block containing a base64 string the agent was asked to decode and pipe to bash. Separately, Unit 42 analysed a money-radar skill that downloaded an affiliate-links file from the author's server on every invocation, steering behaviour after publication. Check Point also documented, as CVE-2026-21852, that until December 2025 an ANTHROPIC_BASE_URL planted in a repository's settings file could redirect the first request — API key included — to a third-party server before any trust dialog appeared.

Why it matters

Skill installation currently combines npm-style convenience with a format whose unit of installation is shell access under your own permissions. Non-interactive paths such as claude -p and the SDK skip the trust dialog and permission prompts entirely, which is exactly how Claude Code runs in CI. Before installing any skill or plugin, the files worth reading are the SKILL.md body and its allowed-tools, any hooks., any .mcp., and whether the source is pinned to a specific sha — because the mechanics documented here run whether or not anyone has looked at them.