Skills and plugins have become one of the most exciting parts of the Claude ecosystem — you can teach Claude new abilities and entire workflows with them. But every extension you install from a third party is also code you didn’t write yourself. That’s exactly where Anthropic’s new feature comes in: automatic security scanning for skills and plugins.
How the scanning works
Enterprise plans can now turn on skill and plugin scanning. The check runs the moment someone uploads or edits a third-party skill or plugin. Claude reviews the contents, looks for signs of malicious behavior — and returns one of three results:
- Pass: Nothing concerning found. The skill or plugin installs normally, with no extra message.
- Warn: Claude couldn’t fully verify the extension. It may carry risk depending on where it came from. It stays usable — but behind a caution banner you have to acknowledge first.
- Fail: The scan detected malicious content. The skill or plugin is blocked and can’t be used.
It all fits into Anthropic’s broader security push. The Claude Security plugin for Claude Code landed recently, letting you scan uncommitted changes or your whole codebase for vulnerabilities. This new scanning, by contrast, targets the supply chain of the extensions themselves.
My take
To me, this is one of the more sensible additions of the past few weeks — especially since I like building and trying out plugins myself. The more skills and plugins are floating around, the bigger the attack surface through exactly this route. A malicious plugin doesn’t need to “hack” anything — you install it willingly.
I like the three-tier model. Not a harsh black-and-white, but an honest “we couldn’t fully verify this” as a middle ground — with a banner that keeps the responsibility visibly on you. The one shame is that it’s Enterprise-only for now. Supply-chain security ultimately affects everyone who uses third-party extensions — and that’s long since more than just large companies.
Sources: Claude Help Center: Get started with skill and plugin scanning, Claude Release Notes