4 Billable Hours per Skill: What a Claude Code Skill Security Audit Costs You
⏱️ The bill: 4.0 hours per skill to read one 2,017-line skill, $202 per skill at $50 per hour.
🔓 The reach: a skill's scripts run as you, and an approved Bash command can write anywhere your account can.
☠️ The record: one scan found 386 malicious skills that stole keys, wallets and passwords.
✅ The way out: read it, run it in a VM first, or have a skill built for your own chore, with a written scope.
Per the opensourcemalware post a lot of the payloads were just sitting in plain text in the first paragraph of the SKILL.md (they found 386 bad skills, no idea how many they looked at in total). So people weren't even opening the file before installing it off clawhub.
What a skill can touch on your PC
A skill is a folder that Claude Code reads and acts on. Here is what that folder can reach, in the docs' own words.
- Scripts
- A skill folder can hold scripts. The docs' own layout comment says they are "executed, not loaded".
- allowed-tools
- "Tools Claude can use without asking permission during the turn that invokes this skill".
- Untrusted folders
- "Workspace trust doesn't gate this field. Claude Code applies a project skill's allowed-tools even in a -p run in a folder you've never trusted."
- Self-grant
- "A skill can grant itself broad tool access, so review the allowed-tools of skills checked into a repository before you run Claude Code there."
- Auto-load
- "Claude can load it automatically when relevant to your conversation". Setting
disable-model-invocation: trueprevents that. - Bash
- "a Bash command you approve can still write anywhere your user account can".
- MCP servers
- Anthropic "does not security-audit or manage any MCP server".
Sources: the Claude Code skills docs and the Claude Code security docs.
How many skills one PC holds, measured by Auto Joe on 2026-10-28 23:18 in the skills folder of the PC it works from:
- 203 skill folders
- 302 SKILL.md files
- 857 script files (.py .sh .js .mjs .cjs .ps1)
- 280,826 lines of .md and script text
- 9 top-level SKILL.md files declare allowed-tools
Think of it like a copy of your house key. The lock cannot tell who turns it, so what counts is who you handed it to.
What the bad ones did
OpenSourceMalware, 2026-02-01: "We found 386 malicious skills."
- Where: they "deliver information-stealing malware to macOS and Windows systems".
- What: it "steals crypto assets like exchange API keys, wallet private keys, SSH credentials, and browser passwords".
- How hidden: "Many of the payloads we found were visible in plain text in the first paragraph of the SKILL.md file."
- Hacker News, 2026-01-30: "Malicious skills targeting Claude Code and Moltbot users", 181 points.
- RankClaw, Show HN 2026-03-07: their claim is 14,706 OpenClaw skills indexed and 1,103 confirmed malicious.
↓
📄 2. Claude reads its SKILL.md
↓
☠️ 3. The payload sits in plain text, first paragraph
↓
🔑 4. API keys, wallet keys, SSH and passwords go
The good news: those payloads were there to read. Reading costs hours, and the next section counts them.
How long does a Claude Code skill security audit take?
At SmartBear's ceiling of 500 lines of code per hour, a 2,017-line skill takes 4.0 hours per skill to read once. At $50 per hour that is $202 per skill, and a 12,071-line skill is 24.1 hours per skill at the same rate.
What SmartBear's code review guide says:
- Per hour: "inspection rates under 500 lines of code per hour".
- At a time: "developers should review no more than 200 to 400 lines of code (LOC) at a time".
- Per review: "a review of 200-400 LOC over 60 to 90 minutes should yield 70-90% defect discovery."
lines / 500 = hours per skillhours per skill x your rate per hour = cost per skill
500 lines per hour is a ceiling, not an average. So every hour below is a floor, and reading slower costs more.
$50 per hour is an example. Put in your own rate, per hour.
| Skill | Lines | Hours | Cost at $50 per hour |
|---|---|---|---|
| copywriting | 412 | 0.8 h per skill | $41 per skill |
| blog-post-GM | 2,017 | 4.0 h per skill | $202 per skill |
| godmode | 12,071 | 24.1 h per skill | $1,207 per skill |
| The whole skills folder | 280,826 | 561.7 h, 203 skills | $28,083 at $50 per hour |
What a vetted skill is
A vetted skill is one a gate read before it shipped. The vault's verify gate is in we threw out 132,000 skills, and this is what one skill's gate cost per run.
| Run | Agents | Subagent tokens | Time |
|---|---|---|---|
| Hardened | 7 | 582,887 | ~17 minutes per run |
| Original | 14 | 1,161,109 | ~40 minutes per run, 2 attempts |
The gate rejected its own first exemplar for a made-up number. It said 8 of 10 DNS lookups, and the real count is 10.
A custom build is $250 fixed, per build, with a written scope first.
A gate earns its cost when it fails its own author: this one caught a made-up number in the first skill it read.
Five checks before you install one
- Read its allowed-tools line. The docs: "review the allowed-tools of skills checked into a repository before you run Claude Code there."
- Read every script in the folder. They are "executed, not loaded", and "You're responsible for reviewing proposed code and commands for safety before approval."
- Set
disable-model-invocation: true. Then it runs only when you call it. - Run it in a VM first. The security docs: "Use virtual machines (VMs) to run scripts and make tool calls".
- Check any MCP server it brings. Anthropic "does not security-audit or manage any MCP server".
Rule of thumb: if you would not run a stranger's script, do not install a stranger's skill unread.
Rather not install a stranger's skill?
Send the chore you want a skill for. You get a written scope first, then a $250 fixed build, per build.
Get a written scope- Reading rate: SmartBear, best practices for peer code review ("Inspection rates should under 500 LOC per hour"; "developers should review no more than 200 to 400 lines of code (LOC) at a time"; "a review of 200-400 LOC over 60 to 90 minutes should yield 70-90% defect discovery.").
- What a skill can do: code.claude.com/docs/en/skills (scripts "executed, not loaded"; allowed-tools; "Workspace trust doesn't gate this field."; automatic loading; disable-model-invocation).
- What an approval reaches: code.claude.com/docs/en/security ("a Bash command you approve can still write anywhere your user account can"; "You're responsible for reviewing proposed code and commands for safety before approval."; "Use virtual machines (VMs) to run scripts and make tool calls"; Anthropic "does not security-audit or manage any MCP server").
- 386 malicious skills: OpenSourceMalware, 2026-02-01. Discussed on Hacker News, 2026-01-30, 181 points.
- RankClaw claim: Show HN, 2026-03-07, 14,706 OpenClaw skills indexed, 1,103 confirmed malicious, as claimed by its makers.
- The skills folder: Measured by Auto Joe, 2026-10-28 23:18, on the PC it works from: 203 skill folders, 302 SKILL.md files, 857 script files, 280,826 lines of .md and script text, 9 top-level SKILL.md files declaring allowed-tools; copywriting 412, blog-post-GM 2,017 and godmode 12,071 lines of md, scripts and json.
- The verify gate: we threw out 132,000 skills (7 agents, 582,887 subagent tokens, ~17 minutes hardened; 14 agents, 1,161,109 tokens, ~40 minutes over 2 attempts originally; 8 of 10 DNS lookups claimed, 10 real).
- The offer: custom build, $250 fixed.
- Every other figure: arithmetic. Hours per skill = lines / 500; cost per skill = hours x rate per hour (412 / 500 = 0.8 h, $41; 2,017 / 500 = 4.0 h, $202; 12,071 / 500 = 24.1 h, $1,207; 280,826 / 500 = 561.7 h, $28,083 at $50 per hour).