Secrets
Not checkedDo not assume this area was assessed.
Developer tools · Security report
Not scanned yetanthropics/skillsIs skills safe to use?
Short answer
We have not scanned skills yet, so we cannot say what a scan would find. Until then, use the checklist on this page and try it in an isolated environment first.
Public repository for Agent Skills
The assessment, at a glance
Security analysis is not available yet
There is not enough evidence to summarize this project’s security. A completed platform job alone does not establish a security result.
Repository snapshot from Plexicus staging. Counts may include earlier scans and are not attributed to an exact run or commit. Check categories come from the latest observed job and can differ from the scans contributing findings. Completed categories describe bundle delivery, not full repository coverage.
What we found
What the scan flagged
Alerts are leads for review, sorted by type and severity. They are not confirmed vulnerabilities.
A breakdown by type is not available yet. Severity totals do not show what kind of issues were flagged.
No results yet.
This project has not been scanned. Unknown results are not the same as zero alerts.
Next steps
How to use skills more safely
Practical steps based on what the scan flagged. They are general guidance, not confirmation of an exploitable vulnerability.
Wait for a repository findings snapshot before drawing a security conclusion.
Try it in a container or virtual machine first, with throwaway credentials.
Pin a specific release or commit instead of tracking the latest code.
There are no scan results yet. Being listed does not mean a project is secure.
What we checked
Which checks ran?
Each card shows whether the latest scan completed that type of check. A completed check does not mean every file or rule was covered.
Code security
Not checkedDo not assume this area was assessed.
Dependencies
Not checkedDo not assume this area was assessed.
Configuration
Not checkedDo not assume this area was assessed.
Limits
What this report cannot tell you
- Alert totals can include results from earlier scans and are not tied to one exact commit.
- Automated alerts need investigation. Severity is a scanner's estimate, not a confirmed impact.
- Zero alerts means nothing was flagged in the checks that ran, not that the project is safe.
- Runtime behavior, deployment settings, MCP permissions, and prompt injection are not assessed unless listed above.
Technical scan record & repository metadata
- Platform execution
- Scan operation failed · needs attention
- Commit evidence
- Scanned commit not verified
- Last checked (UTC)
- 2026-10-26T10:01:27.879Z
- Default branch
- main
Repository metadata retrieved 2026-10-26T05:56:21.816Z. Candidate commit from metadata: dbd4588f9e1033efb41dad4bef2f7947c8993d44. A candidate commit is not proof of the scanned commit.
Questions about skills
Is skills safe to use?
We have not scanned skills yet, so we cannot say what a scan would find. Until then, use the checklist on this page and try it in an isolated environment first.
What did the scan not check?
Runtime behavior, deployment settings, MCP and tool permissions, and prompt injection are not covered unless listed in the checks above. Review those before giving the tool access to real data.
How can I check my own fork or project?
Scan it with the free Plexicus SAST tool. Connect GitHub and get a report for your own repository.
For maintainers
Add the skills security report to your README
Show users where to find this report. The badge links to this page and makes no safety claim.
[](https://www.plexicus.ai/open-source/anthropics/skills/)Your own code
Scan your own repository for free.
Connect GitHub and see what Plexicus flags in your code.
Scan your repository free ↗