Urgent.News

What's breaking now, across thousands of outlets.

AI

Three checks before you install a Claude Code skill (from a review of 783 skills)

Before you install a Claude Code skill, open its SKILL.md and check three things. Does it contain real steps? A one-line stub, a pointer to another file, or unreadable ciphertext means there is nothing to install. Where does your data go? Search the file for URLs, keys and sign-up links. Calling an outside service is fine when you know about it and chose it. Would it work on your machine?…

Before installing a Claude Code skill, inspect three key points listed within the skill's SKILL.md file. Confirm the presence of functional steps; avoid one-line stubs, external links, or unreadable ciphertext. Determine where the skill stores data by searching for URLs, keys, or sign-up requests. Finally, assess if the skill operates correctly on your system, avoiding hardcoded paths, external channels, or sandbox bypass instructions.

A study of 783 skills from the AgentCraft directory identified 317 as unsuitable, with 128 potentially removed by merely checking the first condition alone. Stars on GitHub did not significantly predict which skills were discarded; even highly starred repositories contained dropped skills.

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

This story

This is one outlet's version. Read the fullest account.

Read the original at dev.to →

More in AI

Let’s Talk About Claude Code, Part 2: Container or Sandbox VM?

In Part 1 I said every project of mine now runs in a Docker Sandbox, and I promised to explain why I picked that over a plain dev container.

  • sbx addresses shared kernel and Docker inside Docker security gaps
  • Each agent runs in its own microVM with dedicated kernel and Docker engine
  • Outbound traffic controlled by network policy, git credentials injected by proxy

More from Thursday 5 November →