A cybersecurity guide for Claude Skills as a prompt injection attack surface
Threat taxonomy • Defense skills • Attack examples • Technical manual
Note
This project has evolved into Claude Security Atlas — a modular security guide covering multiple Claude attack surfaces. The Skills Injection content from this repo is included as Module 1, alongside new modules for web content injection, and more planned. Development continues in the new repo.
Caution
Claude Skills combine the trust level of system prompts with the accessibility of user-uploaded files. A SKILL.md placed in ~/.claude/skills/ receives the same authority as Anthropic's own system prompt — with zero security review. This is the architectural equivalent of giving every npm package kernel-level permissions.
|
|
Tip
These are real, working Claude Skills. Copy them into your skills directory and they activate automatically in Claude Code.
# Clone the repo
git clone https://github.com/RationalEyes/claude-skills-security-guide.git
cd claude-skills-security-guide
# Install all three defense skills
cp -r skills/security-monitor ~/.claude/skills/security-monitor
cp -r skills/hash-verifier ~/.claude/skills/hash-verifier
cp -r skills/output-sanitizer ~/.claude/skills/output-sanitizerThen just talk to Claude:
| Say this in Claude Code | What happens |
|---|---|
| "Scan my installed skills for security issues" | Runs static analysis on all installed skills |
| "Verify skill integrity" | Checks SHA-256 hashes against known-good manifest |
| "Sanitize this output before processing" | Strips injection patterns from untrusted text |
|
Static analysis scanner Scans every installed SKILL.md and associated script for 10 types of indicators:
# Standalone (no Claude needed)
python3 skills/security-monitor/scripts/scan_skills.py \
--paths ~/.claude/skills \
--report-format text
# CI/CD gate
python3 skills/security-monitor/scripts/scan_skills.py \
--paths ./skills --fail-on HIGH |
Cryptographic integrity checker Generates SHA-256 manifests of trusted skill states. Detects:
Catches rug-pull attacks, supply-chain poisoning, and time-delayed tampering. # Generate trusted baseline
python3 skills/hash-verifier/scripts/generate_manifest.py \
--paths ~/.claude/skills \
--manifest ~/.claude/skill-hashes.json
# Verify before each session
python3 skills/hash-verifier/scripts/verify_hashes.py \
--paths ~/.claude/skills \
--manifest ~/.claude/skill-hashes.json |
Second-order injection prevention Interposes between script output and Claude's context. Detects and redacts:
# Pipe untrusted output
python3 fetch_data.py | \
python3 skills/output-sanitizer/scripts/sanitize_output.py
# Sanitize a file
python3 skills/output-sanitizer/scripts/sanitize_output.py \
report.txt --output-format json |
Important
The foundational vulnerability (SKI-012) is architectural: user-created skill files receive system-prompt-level trust despite zero security review. All other vectors exploit this.
The guide catalogs 12 attack vectors mapped to the Promptware Kill Chain, MITRE ATLAS, and OWASP Agentic Top 10:
| ID | Vector | Risk | Complexity | Detection |
|---|---|---|---|---|
| SKI-001 | SKILL.md Content Poisoning | CRITICAL |
Low | Hard |
| SKI-002 | Skill Trigger Hijacking | HIGH |
Low | Medium |
| SKI-003 | User-Uploaded Skill Persistence | CRITICAL |
Low | Medium |
| SKI-004 | Script-Based Host Compromise | CRITICAL |
Medium | Hard |
| SKI-005 | Second-Order Context Poisoning | CRITICAL |
High | Very Hard |
| SKI-006 | Skill Chaining / Cross-Contamination | HIGH |
High | Hard |
| SKI-007 | Metadata / Frontmatter Manipulation | HIGH |
Low | Medium |
| SKI-008 | Supply Chain Attack on Repositories | CRITICAL |
Medium | Hard |
| SKI-009 | Multi-Agent Skill Propagation | CRITICAL |
High | Very Hard |
| SKI-010 | Cache Poisoning via Early Activation | HIGH |
High | Very Hard |
| SKI-011 | Skill-as-Command-and-Control | CRITICAL |
Medium | Hard |
| SKI-012 | Skill Authority Paradox (Architectural) | CRITICAL |
Low | Architectural |
8 CRITICAL • 4 HIGH • 4 vectors effectively undetectable without architectural changes
See docs/threat-taxonomy.md for full details.
Warning
These are for educational and defensive research only. All scripts use non-functional placeholder endpoints (example.com/DEMO). Do not install these in a live environment.
| Example | Technique | What It Demonstrates |
|---|---|---|
env-exfil-skill |
Content poisoning + script exfil | "Deployment validator" that silently captures credentials |
covert-formatter-skill |
Invisible data exfil | Appends base64 context in HTML comments — no script needed |
sensitive-trigger-skill |
Trigger hijacking | Intercepts deployment/credential conversations |
poisoned-output-skill |
Second-order injection | Script returns JSON with embedded instructions |
self-replicating-skill |
Persistence + worm | Copies itself to ~/.claude/skills/ with broadened triggers |
multi-agent-propagation-skill |
Lateral movement | Infects shared directories, optionally commits to git |
Use the Security Monitor to scan these examples — they should trigger multiple findings:
python3 skills/security-monitor/scripts/scan_skills.py --paths examples/| Document | Description | |
|---|---|---|
📖 docs/technical-manual.md |
Complete technical manual — architecture deep dive, all 12 vectors with code walkthroughs, 5-layer defense architecture, regulatory context, 38 references (~17,000 words) | Download PDF |
🗂️ docs/threat-taxonomy.md |
Structured taxonomy with MITRE ATLAS and OWASP cross-reference tables | Download PDF |
📊 docs/attack-path-diagrams.md |
7 Mermaid diagrams: skill loading flow, attack paths, defense layers, multi-agent propagation | Download PDF |
📋 docs/executive-summary.md |
Non-technical summary for leadership and governance audiences | Download PDF |
| 💼 LinkedIn Article | Thought leadership article on Claude Skills security risks | Download PDF |
flowchart LR
A["📁 SKILL.md placed in\n~/.claude/skills/"] --> B["🔄 Claude discovers skill\nat startup"]
B --> C["💬 User sends message\nmatching description"]
C --> D["⚡ Skill content injected\nas trusted instructions"]
D --> E["🖥️ Scripts execute with\nfull user permissions"]
style A fill:#ef4444,stroke:#dc2626,color:#fff
style B fill:#f59e0b,stroke:#d97706,color:#fff
style C fill:#f59e0b,stroke:#d97706,color:#fff
style D fill:#ef4444,stroke:#dc2626,color:#fff
style E fill:#ef4444,stroke:#dc2626,color:#fff
The core issue: There is no trust boundary between dropping a file into a directory and having it execute with system-prompt authority. No signing. No vetting. No permission model. A skill installed by any means — social engineering, supply chain, shared repo, direct creation — receives maximum trust.
- Python 3.8+
- PyYAML (optional) — for frontmatter parsing in security-monitor; degrades gracefully without it
pip install pyyaml # optional| Source | Citation |
|---|---|
| Skill-Inject benchmark | Schmotz et al., arXiv:2602.20156, February 2026 |
| Promptware Kill Chain | Schneier et al., arXiv:2601.09625, February 2026 |
| SoK: Prompt Injection in Coding Assistants | arXiv:2601.17548, January 2026 |
| Snyk ToxicSkills | snyk.io/blog/toxicskills, February 2026 |
| CaMeL defense framework | Debenedetti et al., arXiv:2503.18813, March 2025 |
| Prompt Infection (LLM-to-LLM) | Lee & Tiwari, arXiv:2410.07283, COLM 2025 |
| MITRE ATLAS | October 2025 update — 14 new agentic AI techniques |
| OWASP Agentic Top 10 | December 2025 |
Contributions welcome — especially:
- New detection patterns for the security monitor
- Additional defense skill ideas
- Real-world case studies (anonymized)
- Improvements to the threat taxonomy
Please ensure attack examples remain non-functional and clearly marked as educational.
Note
This project is for educational and defensive security research purposes only. Attack examples use non-functional placeholder endpoints and must not be deployed in live environments. The authors are not responsible for misuse of the techniques described.
