enterprise changedagents-and-tools/agent-skills/enterprise
Nearest release: v2.1.312, published under an hour before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+16added
Lines−16removed
From line
20
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits9to this page, all time
The whole hunk
from line 20, old and new numbered
/
from line 20
2020| Risk indicator | What to look for | Concern level |
2121| ------------------------ | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------- |
2222| Code execution | Scripts in the Skill directory (`*.py`, `*.sh`, `*.js`) | High: scripts run with full environment access |
23| Instruction manipulation | Directives to ignore safety rules, hide actions from users, or alter Claude's behavior conditionally | High: can bypass security controls |
23| Instruction manipulation | Directives to ignore safety rules, hide actions from users, or alter Claude’s behavior conditionally | High: can bypass security controls |
2424| MCP server references | Instructions referencing MCP tools (`ServerName:tool_name`) | High: extends access beyond the Skill itself |
2525| Network access patterns | URLs, API endpoints, `fetch`, `curl`, or `requests` calls | High: potential data exfiltration vector |
2626| Hardcoded credentials | API keys, tokens, or passwords in Skill files or scripts | High: secrets exposed in Git history and context window |
from line 32
3232Before deploying any Skill from a third party or internal contributor, complete these steps:
3333
34341. **Read all Skill directory content.** Review `SKILL.md`, all referenced markdown files, and any bundled scripts or resources.
352. **Verify script behavior matches stated purpose.** Run scripts in a sandboxed environment and confirm outputs align with the Skill's description.
352. **Verify script behavior matches stated purpose.** Run scripts in a sandboxed environment and confirm outputs align with the Skill’s description.
36363. **Check for adversarial instructions.** Look for directives that tell Claude to ignore safety rules, hide actions from users, exfiltrate data through responses, or alter behavior based on specific inputs.
37374. **Check for external URL fetches or network calls.** Search scripts and instructions for network access patterns (`http`, `requests.get`, `urllib`, `curl`, `fetch`).
38385. **Verify no hardcoded credentials.** Check for API keys, tokens, or passwords in Skill files. Credentials should use environment variables or secure credential stores, never appear in Skill content.
39396. **Identify tools and commands the Skill instructs Claude to run.** List all bash commands, file operations, and tool references. Consider the combined risk when a Skill uses both file-read and network tools together.
40407. **Confirm redirect destinations.** If the Skill references external URLs, verify they point to expected domains.
418. **Verify no data exfiltration patterns.** Look for instructions that read sensitive data and then write, send, or encode it for external transmission, including through Claude's conversational responses.
418. **Verify no data exfiltration patterns.** Look for instructions that read sensitive data and then write, send, or encode it for external transmission, including through Claude’s conversational responses.
4242
4343<Warning>
4444 Never deploy Skills from untrusted sources without a full audit. A malicious Skill can direct Claude to run arbitrary code, access sensitive files, or transmit data externally. Treat Skill installation with the same rigor as installing software on production systems.
from line 48
4848
4949Claude Enterprise organizations can turn on automated security scanning for custom Skills in claude.ai and Claude Cowork. The setting is **Skill and plugin security scanning** at [claude.ai > Organization settings > Skills](https://claude.ai/admin-settings/skills).
5050
51After you turn on the setting, scanning applies to Skills that members then upload or edit in claude.ai or Cowork. Each scan checks for signs of malicious behavior. These signs include hidden code execution, transfer of your data to an outside service, and instructions that tamper with Claude's safeguards.
51After you turn on the setting, scanning applies to Skills that members then upload or edit in claude.ai or Cowork. Each scan checks for signs of malicious behavior. These signs include hidden code execution, transfer of your data to an outside service, and instructions that tamper with Claude’s safeguards.
5252
5353Whether a Skill is usable depends on its scan:
5454
5555* A Skill that fails the scan is blocked from use.
56* A Skill whose scan hasn't completed is blocked from use.
56* A Skill whose scan hasn’t completed is blocked from use.
5757* A Skill that passes with a warning stays usable behind a caution notice.
5858
5959Organization owners can allow some Skills that failed the scan. So can members whose [custom role](https://platform.claude.com/docs/en/manage-claude/user-management#custom-roles) can manage **Libraries**.
6060
61If scanning is available to your organization, turn it on. Scanning complements, but doesn't replace, the [review checklist](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/enterprise#review-checklist).
61If scanning is available to your organization, turn it on. Scanning complements, but doesn’t replace, the [review checklist](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/enterprise#review-checklist).
6262
63Scanning doesn't cover the Claude API. Skills you upload through the Skills API (`/v1/skills`), including from the Claude Console, aren't scanned, so for API deployments, rely on the review checklist and [version pinning](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/enterprise#versioning-strategy). Scanning also doesn't apply to Skills that were already in your organization when you turned it on, or to organizations with certain data handling configurations, such as customer-managed encryption keys (CMEK), zero data retention (ZDR), or HIPAA readiness. For setup steps, exclusions, and result types, see [Get started with skill and plugin scanning](https://support.claude.com/en/articles/15927065-get-started-with-skill-and-plugin-scanning) in the Claude Help Center.
63Scanning doesn’t cover the Claude API. Skills you upload through the Skills API (`/v1/skills`), including from the Claude Console, aren’t scanned, so for API deployments, rely on the review checklist and [version pinning](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/enterprise#versioning-strategy). Scanning also doesn’t apply to Skills that were already in your organization when you turned it on, or to organizations with certain data handling configurations, such as customer-managed encryption keys (CMEK), zero data retention (ZDR), or HIPAA readiness. For setup steps, exclusions, and result types, see [Get started with skill and plugin scanning](https://support.claude.com/en/articles/15927065-get-started-with-skill-and-plugin-scanning) in the Claude Help Center.
6464
6565## Evaluating Skills before deployment
6666
from line 73
7373| Dimension | What it measures | Example failure |
7474| --------------------- | ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
7575| Triggering accuracy | Does the Skill activate for the right queries and stay inactive for unrelated ones? | Skill triggers on every spreadsheet mention, even when the user just wants to discuss data |
76| Isolation behavior | Does the Skill work correctly on its own? | Skill references files that don't exist in its directory |
77| Coexistence | Does adding this Skill degrade other Skills? | New Skill's description is too broad, stealing triggers from existing Skills |
78| Instruction following | Does Claude follow the Skill's instructions accurately? | Claude skips validation steps or uses wrong libraries |
76| Isolation behavior | Does the Skill work correctly on its own? | Skill references files that don’t exist in its directory |
77| Coexistence | Does adding this Skill degrade other Skills? | New Skill’s description is too broad, stealing triggers from existing Skills |
78| Instruction following | Does Claude follow the Skill’s instructions accurately? | Claude skips validation steps or uses wrong libraries |
7979| Output quality | Does the Skill produce correct, useful results? | Generated reports have formatting errors or missing data |
8080
8181### Evaluation requirements
from line 88
8888
8989Evaluation results signal when to act:
9090
91* **Declining trigger accuracy:** Update the Skill's description or instructions
91* **Declining trigger accuracy:** Update the Skill’s description or instructions
9292* **Coexistence conflicts:** Consolidate overlapping Skills or narrow descriptions
9393* **Consistently low output quality:** Rewrite instructions or add validation steps
9494* **Persistent failures across updates:** Deprecate the Skill
from line 125
125125
126126### Recall limits
127127
128As a general guideline, limit the number of Skills loaded simultaneously to maintain reliable recall accuracy. Each Skill's metadata (name and description) competes for attention in the system prompt. With too many Skills active, Claude might fail to select the right Skill or miss relevant ones entirely. Use your evaluation suite to measure recall accuracy as you add Skills, and stop adding when performance degrades.
128As a general guideline, limit the number of Skills loaded simultaneously to maintain reliable recall accuracy. Each Skill’s metadata (name and description) competes for attention in the system prompt. With too many Skills active, Claude might fail to select the right Skill or miss relevant ones entirely. Use your evaluation suite to measure recall accuracy as you add Skills, and stop adding when performance degrades.
129129
130130Note that API requests support a maximum of 20 Skills for each request (see [Using Agent Skills with the API](https://platform.claude.com/docs/en/build-with-claude/skills-guide)). If a role requires more Skills than a single request supports, consider consolidating narrow Skills into broader ones or routing requests to different Skill sets based on task type.
131131
from line 134
134134Encourage teams to start with narrow, workflow-specific Skills rather than broad, multipurpose ones. As patterns emerge across your organization, consolidate related Skills into role-based bundles.
135135
136136<Tip>
137 Use evaluations to decide when to consolidate. Merge narrow Skills into a broader one only when the consolidated Skill's evaluations confirm equivalent performance to the individual Skills it replaces.
137 Use evaluations to decide when to consolidate. Merge narrow Skills into a broader one only when the consolidated Skill’s evaluations confirm equivalent performance to the individual Skills it replaces.
138138</Tip>
139139
140140**Example progression:**
from line 156
156156
157157### Role-based bundles
158158
159Group Skills by organizational role to keep each user's active Skill set focused:
159Group Skills by organizational role to keep each user’s active Skill set focused:
160160
161161* **Sales team:** CRM operations, pipeline reporting, proposal generation
162162* **Engineering:** Code review, deployment workflows, incident response
163163* **Finance:** Report generation, data validation, audit preparation
164164
165Each role-based bundle should contain only the Skills relevant to that role's daily workflows.
165Each role-based bundle should contain only the Skills relevant to that role’s daily workflows.
166166
167167## Distribution and version control
168168
No line in this hunk matches that.