One developer was installing an app. Claude gave him the download link, and he pasted the command into his terminal.
It was a copycat site. The malware ran.
He wiped the laptop and rebuilt it. Restoring his backup, he found a skill file that looked exactly like his own writing guide.
Buried inside: instructions to download the malware again and take his logins, every time the AI loaded it.
He says reading every file before restoring is what caught it.
Where these files hide
A skill is plain text your AI reads and follows. That is why nobody opens one.
In Claude Code they load from your personal folder, ~/.claude/skills/, and from .claude/skills/ inside any project you open.
The project folder is the one to watch. Clone someone's project and their skills come with it.
The seven checks
Before you open it
1. Read the whole file. Harmful text can sit anywhere in it.
2. Search for the red flags. Anything that downloads, runs a command, or reaches for passwords and keys.
3. Confirm the source yourself. Not through the link you were handed.
When something is off
4. Expect good sites to break. If a file asks for more than its job needs, stop.
5. After a hack, start fresh. Leave the old AI files in the backup.
What it can reach
6. Least access. Which folders, which sites. Nothing more.
7. Secrets out of reach. If the AI cannot open your keys, a bad instruction cannot send them.
The header line to read first
Check the header, not only the words. One field, allowed-tools, lets a skill give itself tools, including running commands.
"Workspace trust doesn't gate this field." That is Anthropic's own documentation.
Search every skill for allowed-tools. If a writing skill lists Bash, ask why.
One setting while you are in there
On Free, Pro and Max, one switch decides whether your chats go into training. Three things to know:
- On: chats can sit in training pipelines for up to 5 years.
- Off does not undo the past. A model already trained keeps what it has.
- The thumbs button keeps the whole chat up to 5 years. Rate from a test chat.
Treat a link your AI gives you like a link from a stranger.
Open one skill file this week before you trust it. Start with the one you did not write.
Reply and tell me which file you opened and what was in it. I read every reply and I will tell you whether it needs a second look.