A 40-second video promises that Claude can run your entire LinkedIn, for free. A GitHub repository flashes on screen, two install commands, upbeat music. Thousands of views, hundreds of comments saying "installed!".
This week one of those videos landed on my feed, and I went to read the code before installing anything. The package was solid: open source, maintained, nothing malicious. Even so, I found three things the video never mentioned. Optional scripts that connect to three outside services. A feature that collects data on the people who liked or commented on your posts, something LinkedIn's terms prohibit. And a file that stores your professional stories, client names included, in a folder with no protection at all.
That was one of the good ones. What about the rest?
What a skill is, without the jargon
Picture a new assistant at the office. You hand them a procedures manual and they follow it to the letter, every time the topic comes up. A skill is exactly that: a folder of instructions (and sometimes small programs) that the AI assistant reads when it needs to do a specific task, like writing a post, building a spreadsheet or reviewing a contract.
The detail that changes everything: the assistant follows the manual with your permissions. If it can read your files, run commands on your computer or access the accounts you connected, the manual can ask it to do those things too. Installing a skill from a stranger is like handing a manual written by someone you've never met to the person who holds your office keys.
The 2026 numbers
Researchers spent the year looking inside these folders, and the results are not reassuring.
A study published in January analyzed more than 31,000 real-world skills and found at least one vulnerability in 26% of them. The most common problem was sending data outside, present in 13% of the total.
In February, security firm Snyk analyzed almost 4,000 skills from two popular marketplaces. 13% had a critical issue, and 76 were malicious on purpose: they stole passwords, installed backdoors or sent files to outside servers. One of them shipped the user's cloud credentials off the machine, hidden inside an encoded command.
Between February and May, Palo Alto Networks' Unit 42 team found five malicious skills that had slipped past every automated scanner. One posed as an AI assistant for stock traders and led to a program that steals information from Macs. Another, disguised as a financial advisor, always recommended the same affiliate links, which its author could swap remotely.
A GitHub star measures popularity. Nobody counts stars to find out whether the code is safe.
Why the video leaves this part out
Most of the time, there's no bad intent. The format doesn't help: a 60-second video lives on views, and "install in two commands" performs better than "read 1,700 lines first". Many creators try the tool, like the result and publish without ever opening the code.
The catch is that these tutorials often ask for exactly what an attacker would ask for: paste your API key here, connect your account there, authorize posting to your profile.
| What the video shows | What's worth asking |
|---|---|
| "Install with two commands" | What do those commands download and run? |
| "It's free" | Does it need a key for an outside service? Who receives my data? |
| "Posts to your LinkedIn on its own" | Who gets permission to post on my profile? |
| "Reads posts and comments" | Is that automated scraping? Does the platform allow it? |
| "Learns your style" | Where are my stories and client data stored? |
Five questions before you install
- Who published it? Check the author's history, other projects and whether there's a channel to report security issues.
- Instructions only, or programs too? A text-only skill carries far less risk than one that ships scripts to run.
- Where does it connect? Web addresses inside the code show where your data could go.
- What permissions does it ask for? API keys, account access and posting rights should each have a clear reason.
- Where does it keep what it learns about you? Files with personal or client data need to be protected and kept out of synced or public folders.
If you don't read code, ask someone in IT, or the AI assistant itself in a separate environment, to review the repository before you install it and explain in plain language what it does.
Or build your own
In my case, the best move was to take the idea and build my own. An instructions-only skill, with my own writing rules, no scripts and no connection to any outside service. It took an afternoon. The safest skill is the one you understand from start to finish.
If you're thinking about using skills or AI agents at your company, or you're unsure about one you saw out there, send me a message and let's talk. I'll go through it with you before you install.
Sources
