Best Claude Skill Security Scanners in 2026: The Buyer's Shortlist

We compared 6 ways to scan a Claude Skill for malicious code and hidden instructions, and ran one of them ourselves against a planted test-file payload. Cisco skill-scanner is our top pick: it is free, runs on your own folder with no account, publishes its own catch rate, and flagged our payload in both places we hid it. Below are the best Claude skill security scanners in 2026, with what each one reads, what it costs and what it misses.

Key Takeaways

• Cisco's free scanner caught our test-file payload. We put the same 2 lines, which send every environment variable to a fake address, in scripts/collect.js and then in tests/reviewer.test.ts. Version 2.2.2 rated both HIGH, so the claim that no scanner reads bundled test files does not hold for Cisco 2.2.2 on plain code.
• Disguised code still gets through. Adversa AI got one malicious skill past all 8 open-source scanners it tested, Cisco's included. Cisco's own README says its rules catch 7.7% of malicious skills at HIGH, or 33.7% with its optional model judge.
• Only 2 of the 6 options scan the folder on your machine. Cisco's is free; Snyk Agent Scan needs a Snyk account. The other 4 scan uploads or registry listings, and we found no documented way to point any of them at your ~/.claude/skills.
• Anthropic's scanning now switches on by default for Enterprise organizations that never set it. It checks third-party skills uploaded to claude.ai and Cowork and returns pass, warn or fail. It skips 6 things, including the Skills API and every skill already in the organization.
• Snyk's scan of 3,984 skills found 76 malicious ones. In total 1,467, or 36.82%, had at least one flaw of any kind. The headline said "1467 Malicious Payloads"; the body says 76, so cite the body.

Free: The book's security-read sheet and release gate, free, for your own skills folder. Get the companion repo on GitHub.

What a Claude Skill Security Scanner Actually Is (and What It Is Not)

A skill is a folder, and a scanner reads the files in it looking for patterns that serve somebody other than you. Anthropic's own review guidance names what to look for and rates each one. High risk: code execution in scripts, instruction manipulation (text telling the model to ignore your rules), references to MCP servers, network access, and hardcoded credentials. Medium risk: how much of the filesystem the skill can reach, and which tools it tells the model to call. Most scanners combine fixed rules with an optional model that reads the prose.

A scanner is not proof a skill is safe. Cisco's README says so directly: a scan that returns no findings "does not guarantee that a skill is secure." Rules recognise known shapes, and a disguised payload is built not to look like one. Cisco's own numbers show the size of the gap: rules alone catch 7.7% of malicious skills on its test set, and adding a model judge raises that to 33.7%.

Nor is it the validator. agentskills validate checks that a skill is well formed: its name, its folder, its required description. It says nothing about what the skill does. And it only reviews every file if it says so. VirusTotal's description of its own coverage reads "starting from SKILL.md and including any referenced scripts or resources," which does not say whether files the skill never mentions are read. A test file is exactly that kind of file, and the installer copies the whole folder.

How We Ranked These Scanners

The criteria come from Anthropic's published review guidance and from one question our book asks of every skill: can you check it before it runs? Facts come from each vendor's pages and the published research; the Cisco results come from our own runs.

• What it reads. SKILL.md only, files the skill references, or the whole folder, including tests/, references/ and assets/.
• Runs on your own folder. Whether you can point it at a skill on your machine before it is installed, or only at uploads and registry listings.
• Account and cost. Free and local, free with an account, or tied to a paid plan.
• Published accuracy. Whether the maker publishes how much it catches and how often it is wrong.
• Output you can act on. Severity levels, named rules, file paths and exit codes you can wire into a pre-commit check or CI.

The Best Claude Skill Security Scanners in 2026

Six options made the list, ordered by how much of a skill they can check on your own machine before it runs. Two are tools you install, one is built into Anthropic's platform, and three are verdicts published alongside skill listings.

1. Cisco skill-scanner, best for scanning your own folder free

At a glance: caught our test-file payload · free, no account · Apache 2.0 · SARIF + exit codes · publishes its catch rate

Cisco AI Defense's scanner installs with pip install cisco-ai-skill-scanner and runs with skill-scanner scan pointed at one skill folder. The default analyzers are fixed rules, YARA signatures and a few code checks, and they need no account and no API key. Optional modes add a dataflow pass, a model judge using your own key, and Cisco's cloud service.

We ran version 2.2.2 three ways on the same small skill. With only SKILL.md, it returned SAFE. With a two-line environment dump in scripts/collect.js, it returned HIGH, rule DATA_EXFIL_ENV_DUMP. With the same two lines in tests/reviewer.test.ts, the hiding place from Gecko Security's research, it also returned HIGH, rule DATA_EXFIL_ENV_DUMP, plus a MEDIUM rule named FILE_MAGIC_MISMATCH.

Cisco publishes its own miss rate. Its README says rules alone "catch 7.7% of malicious skills at HIGH, at a 4.0% false-positive rate," rising to 33.7% at 6.4% with the model judge, on a test set of 839 malicious and 545 harmless skills. It also ships severity levels, SARIF output, exit codes, a pre-commit hook and a GitHub Action. The repo has 2,600 stars and an Apache 2.0 licence file.

Best suited for: anyone who wants a free, local check on every skill before it enters their folder, and in CI. Treat SAFE as one input: a disguised payload got past it in an independent test.

2. Snyk Agent Scan, best for teams already on Snyk

At a glance: skills + MCP servers + agent configs · needs a Snyk account · Apache 2.0 · 3,138 GitHub stars

Snyk's scanner describes itself as a "Security scanner for AI agents, MCP servers and agent skills," and it looks for "prompt injections, sensitive data handling, or malware payloads hidden in natural language." You run it with uvx snyk-agent-scan@latest pointed at a single SKILL.md or a whole folder such as ~/.claude/skills, and it also discovers the MCP servers and agent setups on your machine.

The catch is the account. The README says to "Sign up at Snyk and get an API token" and set it as SNYK_TOKEN, and the analysis runs on Snyk's service, so your skill contents leave your machine. We did not run it, because it needs an account. The code itself is open source under Apache 2.0, with 3,138 stars and release v0.6.8 at the time we checked.

Snyk is also behind ToxicSkills, one of the main public studies of malicious skills, and its analysis powers two other entries on this list: the skills.sh audits page and Tessl's registry scores. Its README documents nothing about bundled test files either way, and it was not among the 8 scanners Adversa AI tested, so its catch rate on disguised payloads is unpublished. Output is risk-based, with flags to ignore known risks in CI.

Best suited for: security teams already paying for Snyk who want skills, MCP servers and agent configs in one report. Skip it if skill contents cannot leave your machine.

3. Anthropic's skill and plugin scanning, best for Enterprise admins

At a glance: on by default for unset Enterprise orgs · pass / warn / fail · claude.ai + Cowork uploads · 6 exclusions

"Skill and plugin scanning is available on Enterprise plans in Claude, Claude Cowork, and Enterprise plugin marketplaces." It started as an opt-in setting and now turns on automatically for Enterprise organizations that have not set it either way. When a member uploads or edits a third-party skill, Claude reviews the contents and returns pass, warn or fail. In the docs' words: "A Skill that fails the scan, or whose scan hasn't finished, is blocked from use. A Skill that passes with a warning stays usable behind a caution notice." Most scans finish in one to two minutes.

The exclusions are the part to read. Scanning does not apply to skills already in the organization when it was turned on, skills you create with Claude, skills shared through a connected MCP server, MCP servers and hooks, or organizations using customer-managed keys, zero data retention or HIPAA setups. The platform docs add a sixth: skills uploaded through the Skills API, including from the Console, "aren't scanned."

The docs describe uploads to claude.ai and Cowork. A skill folder on your own machine is not an upload, so by that scope it is not covered. Anthropic itself frames the feature as one layer: "It complements, but doesn't replace, the review checklist."

Best suited for: Enterprise owners who want a gate on what members upload to claude.ai and Cowork. Other plans do not get it, and by its documented scope it does not reach a developer's local folder.

4. skills.sh audits, best for a quick second opinion on a popular skill

At a glance: 3 scanners side by side · free to read · top skills only

The audits page on skills.sh shows "Combined security audit results from Gen Agent Trust Hub, Socket, and Snyk," one column per scanner, for the most-installed skills on its leaderboard. There is nothing to install and no account to create. You look up a skill and read three verdicts.

Three verdicts are more useful than one, because they disagree. On the day we checked, find-skills read SAFE from Gen, 0 alerts from Socket and MED RISK from Snyk. Matt Pocock's grill-me read SAFE, 0 alerts and LOW RISK. A split like that tells you where to look when you open the folder yourself.

The limits are coverage and detail. The page lists only the top of the leaderboard, a few dozen skills on the day we looked, with several still marked pending. A skill outside that list has no verdict at all. The page does not say which files each scanner read, so you cannot tell whether a bundled test file was in scope. If you install a skill from somewhere other than the source that was scanned, check you are getting the same version.

It sits next to the leaderboard on the same site, so you can go from a popular skill to its three verdicts in one click.

Best suited for: checking a well-known skill in 30 seconds before installing it. If your candidate is not among the most installed, there is nothing here to read.

5. VirusTotal Code Insight on ClawHub, best for OpenClaw users

At a glance: automatic on publish · daily re-scans · benign / suspicious / malicious

VirusTotal, owned by Google, scans every skill published to ClawHub, the skill registry for OpenClaw. You do not run anything. A skill is checked by hash, uploaded for analysis if it is new, and given one of three verdicts: benign skills are approved automatically, suspicious ones carry a warning, and malicious ones are blocked. Active skills are re-scanned daily, which matters because a skill can change after it is approved.

Its coverage is described as "starting from SKILL.md and including any referenced scripts or resources." Read that carefully. A file the skill never mentions, such as a test file sitting in a tests/ folder, is not obviously in scope, and the announcement does not say either way. VirusTotal was one of the three scanners named in Gecko Security's test-file research. It was not among the 8 in Adversa AI's later test.

There is no documented way to point it at a skill on your own machine before you install it, which is the moment our ranking cares about most. If you use OpenClaw, it runs on every published skill without anyone having to remember it.

Best suited for: OpenClaw and ClawHub users, who get it automatically. We found no way to point it at a skill on your own machine.

6. Tessl registry scores, best for comparing skills inside Tessl

At a glance: Snyk-powered · every registry skill · 5-15 seconds per scan

Tessl runs a registry of agent skills, and every skill submitted to it "is automatically sent to Snyk's Batch Skill Analysis API." Each scan takes 5 to 15 seconds and checks for prompt injection, malware payloads, credential mishandling, toxic flow patterns and suspicious external downloads. The result appears on the skill's registry page, so you can compare candidates for the same job side by side before choosing one.

Those five checks line up with most of the high-risk rows in Anthropic's own review table: injected instructions, code that steals or sends data, and content pulled in from outside at run time. Nobody has to request a scan; submission triggers it.

Like the skills.sh audits page, it shows Snyk's analysis without your own Snyk account, as long as the skill you want is in Tessl's registry. Tessl does not state a price for the scores or which files in a skill folder Snyk reads, so the test-file question is open here too.

The same caution applies as with any registry verdict. If you install a skill from its GitHub repository instead of from the registry, check that the copy you get is the one that was scored.

Best suited for: developers choosing between several skills in Tessl's registry for the same task. Of no use for skills outside it.

Side-by-Side Comparison

The same five criteria as the methodology, one row per option. "Not stated" means the vendor's page does not say.

Checked 2026-10-14: Cisco skill-scanner 2.2.2, Snyk Agent Scan v0.6.8. Cisco is the only scanner we ran, so it is the only Yes in the test-file column; "Not stated" means the vendor does not say, not that it misses. NVIDIA SkillSpector (Apache 2.0, 20,200 stars) is another free, local option we did not run. Also tested by Adversa AI and bypassed with one disguised skill: NVIDIA SkillSpector, mondoo skillcheck, skillcop, claude-skill-antivirus, huifer skill-security-scan, ai-skill-scanner and HackMyAgent, alongside Cisco. Sources and check dates are listed under this article.

Which Scanner Fits Your Use Case

Choose by where the skill is when you want to check it.

A Scanner vs Reading the Folder Yourself: What Is the Difference?

A scanner checks for shapes it knows. A read checks what the skill is for, and whether each file serves that purpose. Anthropic publishes the read as an 8-step checklist: read all skill directory content, verify script behaviour matches the stated purpose, check for adversarial instructions, check for external URL fetches or network calls, verify no hardcoded credentials, identify the tools and commands it tells Claude to run, confirm redirect destinations, and verify no data exfiltration patterns.

Our book turns that into a four-minute habit for a typical skill, and adds one question that catches shapes no rule lists: who does this step serve? A line telling the model to skip a confirmation, read ~/.config first, or fetch a style guide at run time serves somebody other than you. Do the read with a scanner, not instead of one, and never let a model's audit replace it, because prompt injection is built to fool exactly that reviewer.

What Results Look Like When We Tested a Scanner Ourselves

We built one small, harmless skill and scanned three copies with Cisco skill-scanner 2.2.2. Nothing was ever executed. Alongside it, here are the published numbers we checked against their sources.

• 3 runs, 2 catches: SAFE with SKILL.md alone; HIGH with the payload in scripts/; HIGH with the same payload in tests/reviewer.test.ts.
• 76 of 3,984 skills malicious in Snyk's ToxicSkills study; 1,467 (36.82%) with at least one flaw; 534 (13.4%) critical; 91% of the malicious ones also used prompt injection.
• 26.1% of 31,132 skills analyzed in the SkillScan study had at least one vulnerability, out of 42,447 collected.
• 0 of 973 skill folders we cloned from 6 popular sources bundle a test file today.
• 8 of 8 open-source scanners missed one disguised malicious skill in Adversa AI's test.

So test files are in scope for at least one free scanner, the 973 popular skills we cloned carry none today, and a disguised payload still got past every open-source scanner Adversa tested. For where those 973 skills came from, see our guide to the best Claude Skills marketplaces.

Get the Four-Minute Security Read in Claude Skills: The Paid Work Playbook

A scanner flags the patterns it knows; Chapter 8 of the book is the read for everything else. You read every file in the folder in a set order and write one row per finding, naming the file and the line. You learn five shapes of hostile instruction to spot in plain prose, plus the question that catches the ones not on the list. Then you rewrite the skill from an empty file, which also settles the licence question for anything you hand a client. Get Claude Skills: The Paid Work Playbook and read your most-used downloaded skill this afternoon.