40Medium
The skill violates naming conventions, lacks a license, and improperly accesses sensitive environment variables, posing a significant risk of credential exfiltration.
HygienePackaging & Manifest2 findings
Skill Info
Nameanthropics/claude-code/plugin-structure
Registrygithub
Version01f1617f1445
PURLpkg:github/anthropics/claude-code@01f1617f1445?skill=plugin-structure
Stars134,979
Installs9,900
Source
Install
This skill has findings worth reviewing before installing.
GitHub
9,900 installs
Skills.shDocs
npx skills add https://github.com/anthropics/claude-codeAssessments (2)
AI Agent Traps ↗Access to sensitive environment variables detectedmediumcredential theftAML.T0055AML.T0037LLM02:2025
Access to sensitive environment variables detected
95% confidenceline 247
${API_KEY}Invalid skill name formatlowpolicy violation
Skill name does not conform to the Agent Skills spec: 1–64 lowercase alphanumeric characters and hyphens, with no leading, trailing, or consecutive hyphens.
100% confidence
Plugin Structure
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Version History (2)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/anthropics/claude-code/plugin-structure)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/anthropics/claude-code/plugin-structure"><img src="https://mondoo.com/ai-agent-security/api/badge/github/anthropics/claude-code/plugin-structure.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/anthropics/claude-code/plugin-structure.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow