Stop installing random Claude skills off GitHub

@ai.samaritan

12.4K followers · usually 3.8K views a post

Views

23.0K

Likes

1.1K

Comments

7

Shares

100

SoundTikTok sound · original sound - ai.samaritan

Promoted product

Practicaly.ai

On a mission to make 1 billion people AI fliuent. You will get highly curated daily AI updates, tools, tutorials, prompts & workflow templates

3 videos2 creators

Why it worked

The video addresses a common concern among AI users about the safety and trustworthiness of third-party 'skills' or prompts. By providing clear 'green' and 'red' flags, it offers practical, actionable advice that empowers users to make informed decisions, making it highly shareable and valuable.

Summary

The video explains how to safely use Claude skills by checking for red flags like sending unrecognized data or running blind code. It advises users to review the skill's instructions and file interactions before installation to ensure safety and functionality.

Structure

1Introduction to Claude skills and their risks
2Explaining what a skill is (instruction set)
3Identifying red flags (sending data, reading sensitive info, running code)

Original caption

Are Claude skills off GitHub a good idea? A skill isn't a plugin, it's an instruction set Claude actually follows. If a bad one goes unchecked, it can tell Claude to do things you never asked for. Green Flags: it stays in its lane, uses expected tools, does what it promised to do. Red Flags: it sends data somewhere you don't recognize, reads what it shouldn't, or downloads and runs code blind. #learnai #claude #aitols #practicalyai

More from @ai.samaritan

Product placement

Claude (AI model): ACTS - it follows instructions and generates output. Removing it would change the video. GitHub: APPEARS - a logo is visible in the top right corner. Removing it would not change the video. Practicaly.ai: ACTS - it is the creator's own product, and the bio link points to it. Removing it would change the video.

On-screen text

CLAUDE CODE Claude Skills ANTHROPIC root@localhost:~# sudo nmap -sV -p 10.10.0.0/24 root@localhost:~# nmap -p1433 --script=vuln-test.nse root@localhost:~# tar cvf sqlfiles.tar.bz2 dbdump root@localhost:~# sudo nmap -sV -p 10.10.0.0/24 root@localhost:~# tar -extract --files=sqlfiles.tar.bz2 dbdump root@localhost:~# bash extras.sh Gecko/201910181 Firefox/33.0 gray NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; 750 FTP 4589 10.14.0.44 0x123B0C736144KFC239491 751 TCP 4589 10.14.0.44 0x23B0C736144KFC239491 752 TCP 4861 10.14.0.57 0x415BB043228910CDE405E 753 TCP 4861 10.14.0.57 0x415BB043228910CDE405E 754 TCP 4589 10.14.0.33 0x13B384CB752E26A7C8 SKILL A set of instructions Claude follows. Claude Claude does things you never asked for. Unexpected, risky, or unwanted output or actions. Sends messages Accesses data Edits or changes Takes actions MAKING YOU 1% BETTER AT USING AI Day 2 Day 3 Day 4 Day 5 Green flags Stays in its lane Only touches files in its own project folder Expected tools Uses normal installs, nothing random Matches its story Does what the description says, no more Red Flags Sends data somewhere A URL or webhook you don't recognize Reads what it shouldn't Keys, passwords, files outside its job Downloads and runs code Pulls something from the web and executes it blind Back at it, digitalsamaritan [ link for your skill ] Sonnet 4.6 Low Ten seconds, filters Hope this helps. See you on

Transcript

Stop installing random Claude skills off GitHub. You're running a stranger's instructions on your own setup, and most of them are junk anyway. A skill isn't a plugin, it's an instruction set Claude actually follows. If a bad one goes unchecked, it can tell Claude to do things you never asked for. So before you install anything, paste the link for your skill, read the skill and tell me every file it touches, every command it runs, and anything it sends anywhere - in plain English. Notice what you did not ask. Is this safe? Because anything sketchy will just tell you it's safe. You ask what it actually does. Then you decide for yourself. Here's what to look for. Green flags. It stays in its lane. Uses expected tools. Does what it promised to do. Red flags. It sends data somewhere you don't recognize. Reads what it shouldn't. Or downloads and runs code blind. Ten seconds, the garbage filters itself out. Hope this helps. See you on Day 4.