Skip to content
T threat.cafe

· Tobias Lindqvist-Rao (editorial persona) · Enforcement architecture · on threat.cafe

Skill scanning in Claude Enterprise skips API uploads, pre-existing skills and ZDR orgs: closing the gaps

Claude Enterprise's skill scanning covers skills that members upload or edit in claude.ai and Claude Cowork after an administrator turns it on. Anthropic's own documentation, read on 15 October 2026, says it does not cover skills uploaded through the Skills API or Claude Console, skills already in the organisation when scanning was enabled, or organisations with customer-managed encryption keys, zero data retention or HIPAA readiness. Claude Code describes no scanning of local skills. Each gap needs its own compensating control: version pinning and checksums for the API, a one-time backfill review for older skills, a Git-based review process for regulated orgs, and managed settings for Claude Code.

The symptom

An administrator enables Skill and plugin security scanning, sees the first malicious upload blocked, and records skills as covered. The setting worked. It covers one path into the organisation, and skills arrive by at least four.

What scanning does

Anthropic's enterprise skills documentation describes the control precisely. After it is turned on at claude.ai, Organization settings, Skills, "Skills that members then upload or edit in claude.ai or Cowork are scanned for signs of malicious behavior, such as hidden code execution, sending your data to an outside service, or instructions that tamper with Claude's safeguards."

The block semantics are fail-closed for the covered path: "A Skill that fails the scan, or whose scan hasn't finished, is blocked from use. A Skill that passes with a warning stays usable behind a caution notice."

Anthropic positions it as one layer: "It complements, but doesn't replace, the review checklist."

The three documented gaps

The same page lists what scanning does not reach.

Skills API uploads. "Scanning doesn't cover the Claude API. Skills you upload through the Skills API (/v1/skills), including from the Claude Console, aren't scanned, so for API deployments, rely on the review checklist and version pinning."

Pre-existing skills. "Scanning also doesn't apply to Skills that were already in your organization when you turned it on."

Certain data handling configurations. Scanning does not apply "to organizations with certain data handling configurations, such as customer-managed encryption keys (CMEK), zero data retention (ZDR), or HIPAA readiness."

The third gap falls on the organisations most likely to hold sensitive data. That is a design consequence, not an oversight: a scan of skill content is processing, and those configurations restrict processing.

The fourth path: Claude Code

The scanning section names claude.ai and Cowork. Claude Code loads skills from other places. The Claude Code skills docs list enterprise, personal (~/.claude/skills/), project (.claude/skills/), nested, additional-directory, plugin and claude.ai-account locations. The page describes no security scanning of skills. Its closest tool, /doctor prompt-audit, checks for outdated or conflicting instructions, not malicious ones.

A documentation tension worth testing

The enterprise page says: "Custom Skills do not sync across surfaces. Skills uploaded to the API are not available on claude.ai or in Claude Code, and vice versa."

The Claude Code skills page describes a sync. When a user signs in with a claude.ai account, "Claude Code loads the skills enabled for your claude.ai account," including "skills your organization provides there." It downloads them to ~/.claude/skills/synced/ and checks for changes about every 10 minutes during active sessions.

Both can be read as true: the API surface does not sync, and claude.ai skills flow one way into Claude Code. The practical consequence matters more than the reading. A pre-existing, unscanned skill on claude.ai can arrive on developer laptops through Claude Code without anyone uploading it there. Test this in your own tenant before relying on either statement.

Compensating controls, surface by surface

SURFACE                     SCANNED?            COMPENSATING CONTROL
--------------------------  ------------------  -----------------------------------
claude.ai / Cowork,         yes, on upload      none needed beyond review checklist
  new or edited skills        or edit
claude.ai / Cowork,         no                  one-time backfill review (below)
  skills present before
  scanning was enabled
CMEK / ZDR / HIPAA-ready    no                  Git as source of truth; two-person
  organisations                                   review; checksums at deploy
Skills API (/v1/skills)     no                  pin `version` on every request;
  and Claude Console                              checksums; separation of duties;
                                                  app-level logging
Claude Code, local skills   no scanning         strictPluginOnlyCustomization
                              described           (skills); disableSkillShellExecution;
                                                  allowManagedPermissionRulesOnly
Claude Code, synced from    depends on the      covered only as well as the
  claude.ai                   claude.ai skill     claude.ai side; syncClaudeAiSkills
                                                  false if that side is unreviewed
Claude Code, plugin skills  no scanning         strictKnownMarketplaces allowlist
                              described
--------------------------  ------------------  -----------------------------------

The fixes

Backfill pre-existing skills

Export the list of skills in the organisation. Review each one against Anthropic's checklist, which asks reviewers to read all skill content, run scripts in a sandbox, check for hardcoded credentials and verify "no data exfiltration patterns."

Inference to test: the scanning text says skills members "upload or edit" after enablement are scanned. Editing a pre-existing skill may bring it under scanning. Confirm that on one test skill before relying on it as a backfill method.

Pin and checksum API skills

Anthropic's guidance for production: "Pin Skills to specific versions. If you omit version, requests use the latest version, so a new version uploaded by anyone in the workspace immediately changes what production agents run." Add the two companion controls from the same page: "Compute checksums of reviewed Skills and verify them at deployment time," and "Skill authors should not be their own reviewers."

Logging is on you. "Usage analytics are not currently available through the Skills API. Implement application-level logging to track which Skills are included in requests."

Regulated organisations: make Git the scanner's substitute

Without scanning, review is the control. Anthropic recommends keeping "Skill source files in Git as the single source of truth," with signed commits and review through pull requests. Require two approvals on any change under the skills directory, and verify a checksum at deploy.

Lock Claude Code skill sources

Three managed settings narrow what Claude Code loads, per the settings reference and skills docs:

  • strictPluginOnlyCustomization with skills locks skills "to plugin and managed sources," removing personal and project skills.
  • disableSkillShellExecution replaces inline shell commands in user, project, plugin and additional-directory skills with [shell command execution disabled by policy]. Managed and bundled skills are not affected.
  • allowManagedPermissionRulesOnly makes Claude Code ignore allowed-tools in project and personal skills.

The skills docs add one warning worth repeating: a project skill's allowed-tools applies "even in a -p run in a folder you've never trusted."

If skills on claude.ai have not been backfilled, set syncClaudeAiSkills to false in managed settings until they are. Re-enable it after the review.

Trade-offs and residual risk

Locking Claude Code to plugin and managed skills moves the review burden to whoever maintains the plugin marketplace. That is the right place for it, but it is a queue, and developers will wait on it.

Disabling sync breaks a convenience users may already rely on. Announce it first.

None of these controls detect a malicious instruction written in plain Markdown that a reviewer misses. An Akto article republished by the Cloud Security Alliance makes the same point: skill attacks "embed malicious instructions in Markdown." Scanning reduces that risk on the covered path. Review is the only control on the others.

Reproduction notes

All behaviour above is from Anthropic's enterprise skills page, Claude Code skills page and settings reference, read on 15 October 2026. Vendor documentation changes. Re-read the scanning section's coverage list before each quarterly review, and re-test the sync behaviour after each Claude Code upgrade.

For the external half of skill review, the threat.cafe board lists documented malicious skills and campaigns with sources and finder credit.

Sources

#claude-enterprise #skills #skill-scanning #claude-code #managed-settings

All posts