A 40-second video promises that Claude can run your entire LinkedIn, for free. A GitHub repository pops up, two install commands, upbeat music. Thousands of views, hundreds of comments saying "installed!".
This week one of those videos reached me, and I went to read the code before installing anything. The package was solid: open source, maintained, nothing malicious. Even so, I found three things the video didn't mention. Optional scripts that connect to three external services. A function that collects data from people who liked or commented on your posts, something LinkedIn's terms prohibit. And a file where your professional stories are stored, client names included, in a folder with no protection at all.
That was one of the good ones. What about the rest?
What a skill is, without the jargon
Think of a new assistant at the office. You hand them a procedures manual and they follow it to the letter, every time the topic comes up. A skill is exactly that: a folder with instructions (and sometimes small programs) that the AI assistant checks when it needs to do a specific task, like writing a post, building a spreadsheet or reviewing a contract.
The detail that changes everything: the assistant follows the manual with your permissions. If it can read your files, run commands on your computer or access the accounts you connected, the manual can ask it to do that too. Installing a skill from a stranger is like handing a manual written by someone you don't know to the person who holds the keys to your office.
The 2026 numbers
Researchers spent the year looking into these folders, and the results are not reassuring.
A study published in January analyzed more than 31,000 real skills and found at least one vulnerability in 26% of them. The most common issue was sending data out, present in 13% of the total.
In February, security firm Snyk analyzed almost 4,000 skills from two popular marketplaces. 13% had some critical issue, and 76 were malicious on purpose: they stole passwords, installed backdoors or sent files to external servers. One of them shipped the user's cloud credentials out, hidden in an encoded command.
Between February and May, the Unit 42 team at Palo Alto Networks found five malicious skills that had slipped past every automated scanner. One presented itself as an AI assistant for stock traders and led to a program that steals information from Macs. Another, disguised as a financial advisor, always recommended the same affiliate links, which the author could swap remotely.
A GitHub star measures popularity. Nobody counts stars to find out if the code is safe.
Why the video leaves this part out
Most of the time, it's not bad faith. The format doesn't help: a 60-second video lives on views, and "install it with two commands" performs better than "read 1,700 lines first". Many creators test the tool, like the result and publish without opening the code.
The catch is that tutorials usually ask for exactly what an attacker would ask for: paste your API key here, connect your account there, authorize posting to your profile.
| What the video shows | What's worth asking |
|---|---|
| "Install it with two commands" | What do those commands download and run? |
| "It's free" | Does it need a key for some external service? Who gets my data? |
| "Posts to your LinkedIn on its own" | Who ends up with permission to post on my profile? |
| "Reads posts and comments" | Is that automated scraping? Does the platform allow it? |
| "Learns your style" | Where are my stories and client data stored? |
Five questions before installing
- Who published it? Check the author's history, their other projects and whether there's a channel to report security issues.
- Just instructions, or programs too? A skill made only of text carries much less risk than one that ships scripts to run.
- Where does it connect? Internet addresses inside the code show where your data could go.
- What permissions does it ask for? API keys, account access and posting authorizations should have a clear reason.
- Where does it store what it learns about you? Files with personal or client data need to be protected and kept out of synced or public folders.
If you don't read code, ask someone from IT, or the AI assistant itself in a separate environment, to review the repository before installing and explain in plain language what it does.
Or build your own
In my case, the best way out was to take the idea and build my own. A skill made only of instructions, with my writing rules, no scripts and no connection to any external service. It took an afternoon. The safest skill is the one you understand from start to finish.
If you're thinking about using AI skills or agents in your company, or you're unsure about one you saw out there, message me and let's talk. I'll review it with you before you install it.
Sources
