Claude Code Skills 安全吗？安装前如何审查

AI skills run with your permissions and pull in real dependencies. Here is a practical security checklist before you install any skill.

7-point checklist

1. Review the GitHub repository — check stars, recent commits, and issue activity.
2. Read SKILL.md permissions — understand what the skill asks to access.
3. Check dependency audit results — npm audit, pip audit findings.
4. Scan for prompt injection — unusual instructions targeting the model.
5. Verify the author — official org vs unknown fork.
6. Test in a sandbox — isolated environment first.
7. Monitor after install — watch network and file access.

Use SkillTip security reports as a starting point, not a guarantee.