Security Guide
Understanding risks and best practices for AI skill installation
Important: Third-Party Code Execution
Skills from SkillzWave are third-party code that runs in your AI assistant's execution environment. They have access to your files, can execute commands, and interact with your system. Always review skills before installing them.
Understanding the Risks
What Skills Can Do
- • Execute code and shell commands on your computer
- • Read, write, and modify files in your projects
- • Make network requests to external services
- • Access environment variables and configuration
- • Install packages and dependencies
Potential Risks
- • Malicious code: Skills could contain harmful code that damages your system
- • Data exfiltration: Skills could send your code/data to external servers
- • Supply chain attacks: Compromised dependencies in the skill
- • Unintended bugs: Poorly written skills that break your workflow
- • Abandoned skills: Outdated code with security vulnerabilities
Security Best Practices
1. Review the Code Before Installing
Always check the skill's source code on GitHub before installation. Look for:
- • Clear, documented code that matches the description
- • No suspicious network requests or external dependencies
- • Recent updates and active maintenance
- • Community feedback in issues and pull requests
2. Check the Author's Reputation
Evaluate the skill creator's trustworthiness:
- • Look at their other repositories and contributions
- • Check if they're a known developer in the community
- • See if the skill is officially endorsed or verified
- • Look for official Anthropic or platform-verified skills
3. Use Quality Scores as Guidance
SkillzWave provides quality scores based on multiple factors:
4. Test in a Safe Environment First
Before using skills on important projects:
- • Test skills in a separate, non-critical project
- • Use version control (git) to track any changes
- • Start with simple tasks to understand behavior
- • Monitor what files the skill accesses
5. Keep Skills Updated
Regularly update installed skills to get security patches:
- • Check for updates monthly
- • Review changelogs before updating
- • Remove skills you no longer use
- • Watch the GitHub repository for security alerts
Red Flags to Watch For
Be extra cautious if you see any of these warning signs:
- Obfuscated or minified code that's hard to read
- Requests for credentials or API keys without clear justification
- Network calls to unknown or suspicious domains
- No README, documentation, or unclear purpose
- Repository abandoned for over a year with no activity
- Author has no other public repositories or contributions
- Capabilities that seem excessive for the stated purpose
What SkillzWave Does
SkillzWave provides tools to help you evaluate skills, but we do not audit or guarantee their security:
- Quality scores based on code structure, documentation, and maintenance
- Metadata including stars, forks, and last update date
- Direct links to source code on GitHub for your review
- Categorization to help you find relevant, well-organized skills
You are responsible for reviewing and evaluating skills before installation. SkillzWave is a discovery tool, not a security auditor.
Report a Security Issue
Found a malicious skill or security vulnerability in our marketplace? Please report it immediately: