Picture a weekday morning at your agency. Someone in a polo with an alarm company logo is at the back door with a clipboard, saying the panel needs an update. He knows the brand of your system and he seems to know what he's doing. Nobody on your team would hand him the code without calling the alarm company first, and the laminated card by the door probably says so.
An AI skill can be that visitor. A skill is a short set of instructions, sometimes with scripts attached, that an AI assistant picks up when a particular job comes up. The good ones make an afternoon shorter: a producer finds a Medicare compliance reviewer someone posted online, uploads it, and the first pass on every flyer gets faster. The catch is that the skill works with whatever access the assistant already has, and nobody called to check who sent it.
Anthropic said as much when it launched skills. Because they give Claude the ability to execute code, the company told users to be "mindful about which skills you use" and to "stick to trusted sources to keep your data safe." That's good advice, and almost everything written since assumes the reader can read code. This post is for the agency owner who can't, and shouldn't have to.
What's actually happened so far
The research on skill security is only a few months old. Here's what it found, translated.
A January 2026 study by Yi Liu and colleagues analyzed 31,132 skills collected from two large marketplaces. About a quarter of them, 26.1%, had at least one security vulnerability. Skills that bundled executable scripts were 2.12 times more likely to have one than skills made of instructions alone.
In early February, Koi Security audited all 2,857 skills on ClawHub, an open marketplace for the OpenClaw agent, and found 341 malicious ones, 335 of them apparently from a single campaign. According to the coverage of that audit, the campaign delivered Atomic macOS Stealer, malware sold as a service that collects saved browser passwords, keychain passwords, SSH keys and API tokens. Palo Alto Networks' Unit 42 cites the same 341 in its own report on the marketplace, and notes that Trend Micro separately confirmed skills distributing that stealer. Around the same time, Snyk scanned 3,984 skills from ClawHub and skills.sh: 36.82% had a security flaw of some kind, 13.4% had a critical one, and human reviewers confirmed 76 as malicious.
Keep those numbers in proportion. The confirmed malware in every one of those reports was found on open marketplaces where anyone can post a skill. The larger percentages count flaws of every severity, from critical down to minor. What the research supports is caution about where a skill comes from, the same caution you'd give the visitor at the back door.
The door has more entrances now, too. Claude, ChatGPT and Gemini all let you upload a skill that was built somewhere else, so the checks below apply to anything someone imports, not only to marketplace downloads.
Six checks before anyone installs a skill
1. Start with your own. The safest skill is one your team wrote. Most of what an agency needs is plain instructions with an example or two, the kind a producer can write in an afternoon, and instruction-only skills were the lower-risk group in the Liu study. If you're rebuilding custom GPTs as skills, How to Migrate a Custom GPT to a Skill walks through writing your own, and Skills vs Projects vs Connectors vs Plugins covers what belongs in a skill at all.
2. Ask who sent it. Before anything gets installed, know where it came from: a person you can name, a company you can call, a page that will still be there next month. "I found it on GitHub" is the start of that answer, not the end of it. If nobody can say who wrote it, it doesn't go in.
3. Read it before you install it. A skill is a folder, and its main file, SKILL.md, is written in plain English. Read all of it. Anthropic's own help page tells anyone using a skill from a less-trusted source to audit it first, starting with the files bundled inside and paying attention to code dependencies and any scripts. If the folder has scripts and nobody at the agency can read them, find someone who can, or pass. Nobody's judging your team for that. You'd follow the same rule with a contract written in a language nobody in the office reads.
4. Know the red flags. Stop if a skill asks for a password, an API key or a login it has no obvious reason to need, if its instructions send anything to a website you didn't expect, or if it tells the assistant to keep something from you. That last one sounds paranoid until you see the title of a February research paper on malicious skills: "Do Not Mention This to the User." A skill that hides things from the person using it isn't working for that person.
5. Keep an approved list, with an owner. Write down which skills are in use, where each one came from, who reviewed it and who owns it now. A shared document is enough. The point is that every new skill becomes a decision someone made rather than something that showed up, which is the same rule every seat on a Digital Crew follows: a named person answers for it.
6. Keep client data and outbound actions behind a person. No skill touches client health information unless the plan it runs on is covered by a business associate agreement, and even then, check your settings. Anthropic turns skills off by default for organizations with HIPAA-ready configurations, and an admin has to turn them back on. Anything a skill would send, file or change outside the chat gets a human approver before it goes. What Google's HIPAA Coverage for Gemini Actually Means for Insurance Agents and Is Your AI Notetaker HIPAA Compliant? walk through the BAA questions to ask.
The controls you may already be paying for
If your agency is on a business plan, some of this is built in. In ChatGPT Business, Enterprise, Healthcare and Edu workspaces, every uploaded skill is scanned and marked Available, Needs Review or Blocked, and Enterprise and Edu admins decide who can upload, share and install skills. On Claude Team and Enterprise, admins can provision approved skills to the whole organization, and Enterprise admins can switch on a check that scans each third-party skill or plugin for malicious content before it can run. Anthropic's admin guide also suggests testing a skill on one account before rolling it out to everyone, which is a good habit on any platform.
Microsoft 365 agencies are getting the same kind of controls. On September 30, Microsoft began rolling out a plugin registry for Copilot, where admins choose which publishers staff can install from, assign each plugin to specific people or groups, and approve every new connection to an outside system in two steps before anyone can use it. Microsoft hasn't said when each organization gets it, so check your admin center rather than assuming. One caution comes with it. A Copilot plugin can bundle skills, connections and agents into a single package, which makes it easier to install and harder to see what you're agreeing to. Open the package and look at what's inside before you approve it, the same way you'd read a skill.
Use those controls, and don't lean on them. OpenAI's own help page says its scan "should not replace your own review, policies, or judgment." Anthropic's scanning isn't available at all for organizations using HIPAA configurations, which is exactly where a Medicare agency is likely to be. A scanner is a smoke detector. Every office should have one, and nobody mistakes it for the fire plan.
If your agency already has an AI policy, these six checks belong in it, right next to the list of approved tools. If it doesn't, AI Policy for Insurance Agencies covers why that gap is an E&O problem and what the policy needs to say.
Two minutes at the back door
The person in the polo might be exactly who he says he is. The call to the alarm company takes two minutes, and nobody on your team feels insulted by it. A skill deserves the same two minutes. Once the checking is a habit, your team can say yes to the good ones without wondering what came in with them.
If you suspect AI tools and skills are already in use at your agency without anyone signing off, that's normal, and it's where the Shadow AI Governance Launchpad starts. It's a free kit with amnesty email scripts, a three-question survey, a data classification guide and policy templates for bringing that use into the open.
Frequently asked questions
Are the skills Anthropic and OpenAI publish safe to use? They're the trusted sources both companies point you toward, and they're the starting point this checklist assumes. Read the instructions anyway, so you know what the skill does and what it touches before it's part of someone's day.
Do instruction-only skills need the same review? Yes, though it goes faster because there's no code to check. Instructions alone can still tell an assistant to send data somewhere or to hide what it's doing, and Anthropic names prompt injection and data exfiltration as the two main risks of skills from untrusted sources.
What if someone already installed a skill we haven't reviewed? Run it through the six checks now. Add it to the approved list if it passes, and remove it if it doesn't. Don't make it a disciplinary moment: the people who tell you what they've installed are the ones you want to keep telling you.
The Skills series
Every post in the series on custom GPTs, Gems and skills, in the order it ran.
- OpenAI Is Retiring Custom GPTs. Here's the Official Record.
- How to Migrate a Custom GPT to a Skill (ChatGPT or Claude)
- On ChatGPT Plus? Your Custom GPT Options After December 11
- Skills vs Projects vs Connectors vs Plugins, Explained for Agency Owners
- 8 AI Skills Every Insurance Agency Should Build First
- Your Medicare AI Prompts Are Still Running Last Year's Rules
- Before You Install That AI Skill, Run This Checklist (you're here)
