SkillSafe + Claude Code

1. Install a skill (recommended)

The fastest way to install a verified skill into Claude Code is the SkillSafe desktop app (macOS / Windows / Linux). On any skill page, click View in SkillSafe app — the app re-runs a local scan, verifies it against the publisher's report, and writes files to ~/.claude/skills/.

Or install from the command line with Vercel's skills CLI — every SkillSafe skill is cloneable via git, so it works natively:

npx skills add https://api.skillsafe.ai/owner/skill-name

The skills CLI auto-detects Claude Code and writes files to the correct location.

Note: Claude Code reads from ~/.claude/skills/, .claude/skills/, and .agents/skills/. The skills CLI and the desktop app both write to the project-local .claude/skills/ directory by default.

Agent prompt

Paste this into Claude Code when you want the agent to handle setup and verification:

Find a security-scanned skill on SkillSafe for my task, prefer clean scans and tested skills when available, then install it with the SkillSafe desktop app or npx skills add. Before using it, review the SkillSafe security tab, source, and exact version.

2. Optional: add the SkillSafe MCP server

Install skills with the desktop app or npx skills add from step 1. If you also want in-tool search, scanning, and publishing without leaving Claude Code, add the SkillSafe MCP server to ~/.claude/mcp_servers.json:

{
  "skillsafe": {
    "type": "url",
    "url": "https://api.skillsafe.ai/mcp"
  }
}

Restart Claude Code to pick up the MCP server. You'll get 8 native SkillSafe tools (search, scan, save, share, etc.) — useful for power users, but not required for installing skills.

3. Find more skills

Browse the verified skill registry by category, tag, or publisher, then install any skill with the desktop app or npx skills add from step 1.

If you added the MCP server in step 2, you can also discover skills conversationally — just ask Claude Code naturally:

"Find a code review skill on SkillSafe"

Your agent calls search_skills or recommend_skills to surface matches; install the one you want with the desktop app or npx skills add from step 1.

4. Scan for security issues

Every shared skill on SkillSafe is already scanned, and the desktop app re-verifies each skill against the publisher's report on install. To check anything yourself, paste a GitHub URL into the free scanner — no signup required.

With the MCP server, you can also scan from inside Claude Code:

"Scan this skill for security issues" or "Scan my MCP config for poisoning"

Uses the scan_skill and scan_mcp_config tools. Detects prompt injection, credential theft, exfiltration, and 40+ other patterns. See the full ruleset →

5. Save & share your own skills

Publish your own skills to the registry from the desktop app or the web dashboard. Skills are private by default — sharing creates revocable links and requires a clean scan report.

With the MCP server, you can save and share directly from Claude Code (add an API key to your MCP config headers):

"Save this skill to SkillSafe as @myname/my-skill version 1.0.0"

Uses the save_skill and share_skill MCP tools.

Other tools

Next steps