One in five Claude Code skills runs a bundled script. We read what those scripts do

Summary

Before you install a Claude Code skill, open its folder and look for a scripts/ directory. If the SKILL.md tells Claude to run a file from it, read that file, and read the skill’s allowed-tools line too.

The reason is simple. A skill is more than instructions. In 979 of the 5,036 community skills we read from our directory, about one in five, the SKILL.md tells Claude to run a script that ships with the skill. That script runs on your machine with your permissions. And if the skill’s allowed-tools lists Bash, Claude can run it, and any other shell command, without asking you during that turn.

Quick guess: how many of those scripts reach the network? 272 skills, about one in twenty. Many of them call the API the skill is about, and 93 of them also read an environment variable named like a secret, such as an API key.

Our picks

Three checks we now run before installing a skill:

1. Find the scripts the SKILL.md names, and search them. Look for curl, requests, fetch and wget (network), rm -rf and shutil.rmtree (recursive deletes), pip install and npm install run from the script, and environment variables with KEY, TOKEN or SECRET in the name. Each one is fine when it matches what the skill says it does.
2. Read allowed-tools. The listed tools run without a permission prompt during the turn that invokes the skill. Bash(git status *) allows that one command. A bare Bash allows any command. The docs also note that workspace trust does not gate this field, so a project skill applies it even in a folder you have never trusted.
3. Search the SKILL.md for !`. A line like !`git diff HEAD` runs a shell command when the skill loads, before Claude reads the skill, and pastes the output in. It is a useful feature, and it is also code that runs before anyone looks at it.

How we tested

1. Skills. All 5,082 community skills in our directory, the ones that passed our review. The directory’s other 19 are Anthropic’s official skills, which we left out. We could read 5,036; the rest were in deleted repos or could not be fetched. We also read the 317 skills our November review dropped, to compare.
2. Files. One GitHub tree per repo, then the SKILL.md and its scripts from that same commit. A script is a .py, .sh, .js, .ts, .mjs, .rb, .pl or .ps1 file in the skill’s folder. We skipped folders that belong to another skill, plus node_modules, tests, fixtures and build output. We went at most three levels deep.
3. Runs a bundled script. We count a skill here when its SKILL.md names one of those files. Everything we say about what scripts do is counted on these named scripts only.
4. Reading. Pattern rules on the source with comments removed. Nothing was installed or run. We checked samples by hand and fixed four rules that over-counted, for example printed “pip install X” hints that never run.

Results

Out of 5,036 skills in the directory:

What the skill does	Skills	Share
Ships script files	1,175	23.3%
SKILL.md tells Claude to run one of them	979	19.4%
The script writes or deletes files	691	13.7%
The script starts other programs	342	6.8%
The script goes online	272	5.4%
The script goes online and writes files	236	4.7%
The script deletes folders recursively	122	2.4%
The script reads an environment variable named like a secret	119	2.4%
The script reads a secret-named variable and goes online	93	1.8%
The script names a credential file (.env, ~/.ssh, ~/.aws/credentials)	57	1.1%
The script installs packages itself	43	0.9%
The script uses sudo	10	0.2%
SKILL.md sets allowed-tools	563	11.2%
allowed-tools pre-approves Write or Edit	249	4.9%
allowed-tools pre-approves Bash for any command	233	4.6%
allowed-tools pre-approves Bash for listed commands only	151	3.0%
Runs a bundled script and pre-approves Bash for any command	50	1.0%
SKILL.md runs a command on load with !`	40	0.8%
SKILL.md registers hooks that last the whole session	13	0.3%

A few examples, without names:

• Network. A website audit skill fetches the live pages it scores. A graph database skill calls the vendor’s REST API to create and run agents. Both go online because that is the job.
• Secrets. An SEO checklist skill loads its own API keys from ~/.config/<tool>/.env. That is why it names a .env file. It is also the line to read, since the same code could read any file you can.
• Deletes. A music video skill removes a project folder with shutil.rmtree. Check what path a recursive delete gets.
• Installs. A slide deck skill’s PPTX export script runs npm install inside the skill’s own folder.
• Bash for any command. An experiment loop skill pre-approves Read, Write, Edit, Bash and Agent, and runs its own tree script. Inside that turn, none of those tools asks you first.
• On load. A memory recall skill uses !` to run a script from its plugin folder as soon as it loads.

Many of the 979 are ordinary: a scaffolder that creates the folders it needs, a deploy script that cleans up its temp folder. The point of the checks is to see that the script matches the skill.

What the dropped skills tell us

Our November review dropped 317 of the 783 new skills it read. We read those 317 the same way and matched each one to its published drop reason.

Why the review dropped it	Skills	Runs a bundled script	Script goes online	Script writes files
Evades detection or platform rules	35	48.6%	20.0%	42.9%
Unsafe	41	39.0%	14.6%	29.3%
Paid API or ad funnel	65	21.5%	16.9%	12.3%
Only useful to its author or one project	46	13.0%	6.5%	10.9%
Placeholder, template, demo or test fixture	108	6.5%	0%	0%
Kept in the directory	5,036	19.4%	5.4%	13.7%

Skills dropped as unsafe run a bundled script 2.0 times as often as the skills we kept (39.0% against 19.4%), and skills dropped for evading platform rules 2.5 times as often (48.6%). Their scripts go online 2.7 and 3.7 times as often (14.6% and 20.0% against 5.4%). Templates and demos almost never ship scripts, which pulls the dropped group’s overall average down to 20.2%, close to the kept 19.4%.

So a script is a normal part of a skill. In the two groups the review dropped for safety and rule breaking, scripts show up 2 to 2.5 times as often as in the skills we kept, and those scripts go online 2.7 to 3.7 times as often. Those are the skills where reading the script pays off most.

What to ignore

The file count. A skill with forty helper scripts can be harmless, and a skill with one can send your keys somewhere. Read the scripts the SKILL.md actually names.

Limitations

• Static only. A named script may not run every time. Pattern rules miss calls built at runtime and can match a command inside a string. Network counts include some browser code that loads local files, and credential paths include security scanners that list those paths as patterns to block.
• One snapshot. Skills entered the directory over time. We read every script at its repo’s current commit on November 6, 2026, so some authors have changed things since their skill was listed.
• Not cause and effect. The dropped skills are the ones our review flagged, not a random sample. The comparison shows which problems tend to come with scripts. It does not show that scripts get skills dropped.
• Capabilities, not intent. We did not judge whether any script misuses what it does.

Reproduce it

The counts above, for kept skills, dropped skills and each drop reason, are in skill-scripts-2026-11.json. Repo and skill names are left out. To check one skill yourself, open its folder, find the file names its SKILL.md mentions, and search them for the patterns in the first check above.

The skills we kept, with install commands, are in the AgentCraft skills directory: 5,101 Claude Code skills, and every community skill is reviewed before it’s listed.

Sources

1. Claude Code docs: Skills (Pre-approve tools for a skill, Inject dynamic context) · official
2. Agent Skills specification · official
3. AgentCraft: We reviewed 783 new Claude Code skills; 317 didn't make our directory · blog