Safety: read a skill before you install it

A skill is a folder of text that your agent reads, not a program you launch. But that text steers what the agent does next: which commands it runs, which files it opens. A few minutes of reading before you install removes most of the risk.

What a skill can make the agent do

The SKILL.md file holds Markdown instructions. When the agent judges them relevant to your request, it loads them and follows them like any other instruction. A skill can therefore ask it to:

• read or edit files in your project;
• run commands in the terminal;
• call a script stored in the skill's folder;
• fetch a web address.

The Agent Skills specification does define an optional scripts/ folder for executable code, and an experimental allowed-tools field listing pre-approved tools. Support for that field varies between agents.

In Claude Code, allowed-tools grants the listed tools without a confirmation prompt during the turn in which the skill is invoked. The documentation notes that workspace trust does not gate this field: a skill checked into a repository can give itself broad tool access. Review the field before opening a repository that contains skills.

Read a skill in two minutes

Before installing, open the files and check, in this order:

1. The frontmatter (the header between two lines of dashes): name, description, and above all allowed-tools if present.
2. The commands: look through code blocks and for words like curl, wget, rm, sudo, chmod, eval, ssh.
3. The scripts/ folder: if it exists, read every file. A script does what its code says, not what the description promises.
4. The addresses: any URL the skill sends data to or downloads something from.
5. Hidden instructions: a directive unrelated to the stated task is a warning sign.

Here is a header worth a closer look. The allowed-tools field lets every curl command run without confirmation:

---
name: page-audit
description: Audits a web page. Use when the user asks for an audit.
allowed-tools: Bash(curl:*) Read
---

It is not necessarily malicious, but you should know why the skill needs it.

Your agent's permissions

Do not rely on reading alone: configure the agent too. In Claude Code's manual mode, reads inside the working directory need no approval, while shell commands (except a built-in set of read-only ones), file edits and web searches ask first, as do most web fetches.

Rules are evaluated in the order deny, ask, allow, and the first match wins. A deny rule set at any settings level beats an allow rule from another level. You can therefore block in advance what must never happen, such as reading ~/.ssh, whatever skill is installed.

Read what the agent is about to do before you accept. Avoid "Yes, and don't ask again" for a command you do not understand.

Why PalateKit leaves out third-party resources that ship scripts

A skill made of plain text can be read in a few minutes. A skill that bundles scripts needs a code audit, and its description says nothing about what they actually do. PalateKit therefore applies one rule: the catalog does not list third-party resources that ship scripts. The only exception is PalateKit's own house resources (such as PalateKit Motion): we write their scripts ourselves, they go through a security review before release, and their page says what you need to install to run them.

What the catalog guarantees:

• installing copies files and runs nothing;
• each page lists its files, its author and its license;
• a rejected resource is not listed.

This does not replace your own reading: a plain-text instruction can also push the agent to run a command. Always read.

License and notice

Each resource keeps its author's license (MIT, Apache-2.0, CC0 or CC-BY for what is re-hosted). The page shows the original license, the author, the source link and, when the resource was translated or corrected, a "modified by PalateKit" notice. The notice file is included in the installed folder: keep it if you redistribute the skill. The author's files stay in their original version, often in English.

Report a resource

If a resource contains dangerous code or instructions, a licensing error, or content you wrote and want removed, use the /en/takedown page. Name the resource, give the reason and, for a copyright claim, show that you hold the rights. In the meantime, uninstall the skill by deleting its folder.

Going further

• Install your first resource
• Browse skills