When a “Handy Extension” Becomes the Way In──Anthropic Puts an Enterprise Checkpoint on Claude Code Skills and Plugins
On August 6, Anthropic added a malicious-content review (Enterprise, beta) targeting third-party Claude Code skills and plugins. Behind it are researchers' warnings that extension marketplaces can become a supply-chain attack surface. Here's how it works and what adopters can do to protect themselve
What makes a coding agent smart are the extensions bolted on after the fact. Install a Claude Code "Skill" or "Plugin," and you can teach the agent set procedures and tools. But that convenience has a flip side: "code someone else wrote is entering your agent from the inside, with high privileges." On August 6, 2026, Anthropic added a security review (beta) for Enterprise plans, targeting third-party skills and plugins. It automatically checks for malicious code whenever someone uploads or edits one. It's a modest addition, but behind it lie repeated warnings from security researchers that "extension marketplaces can become a supply-chain attack surface."
Extensions Cross Your "Trust Boundary"
Why is a checkpoint needed? The dangers researchers point to boil down to roughly the following. Each is best taken in the spirit of "this is a risk that has been flagged," but as mechanisms they are concrete.
- They run with high privileges: A plugin runs with the same privileges as the user and effectively acts as a proxy for package management. There is little transparency into what it fetches and from where, security firm SentinelOne notes.
- Dependency hijacking: When you ask it to install a library, a malicious skill can swap the source to a location the attacker controls and pull in a tainted version. The import succeeds, the sample runs――on the surface nothing breaks, while exfiltration of secrets or monitoring of traffic gets planted. That's the scenario.
- They persist across sessions: Once enabled, a skill keeps shaping the agent's behavior in subsequent sessions. It doesn't end with a single act of mischief.
- The bar to publish is low: Some registries crawl GitHub hourly to automatically collect new marketplaces, so a listing spreads roughly 60 minutes after it goes public. By default there is neither signing nor review, PromptArmor reports.
- Impersonation: As a proof of concept, PromptArmor created a fake account (anthropics-claude) resembling the official one (anthropics) and showed that it could attract invitations.
The common thread is the view that installing an extension is the same as "inviting all of its maintainers into your own trust boundary." Connecting to a marketplace means pulling every unvetted author listed there wholesale into your company's supply chain.
The Three Lines of Defense Anthropic Put in Place
This review is less a standalone feature than one layer of the defenses Anthropic has stacked over the past few days. Here are three, each with a different purpose.
| Date / Feature | What it inspects | Scope |
|---|---|---|
| Aug 6 — Skill/plugin review (beta) | Automatically inspects third-party skills/plugins for malicious content on upload and edit | Enterprise |
| Aug 5 — Inference hooks (beta) | Inspects all prompts and tool responses and applies policy before they reach Claude (across chat / Claude Code / Cowork) | Enterprise |
| Jul 21 — Claude Security plugin (public beta) | Scans repositories for vulnerabilities with multiple agents and proposes fix patches (on "your own code," not extensions) | All Claude Code users |
The point to keep in mind here is that what the August 6 review inspects is "the extension itself." It faces a different direction from the Claude Security plugin, which hunts for vulnerabilities in the code you wrote; it is a checkpoint that verifies, at the entrance, the safety of tools brought in from outside.
What Adopters Can Do Right Now
The review is still in beta, and it's Enterprise-only at that. If you're using Claude Code as an individual or on Team, for now you'll need to defend yourself operationally. Here are the key points of the procedure.
- Narrow what you connect to: Restrict, organization-wide, which marketplaces and publishers can be added. Don't default to an unvetted registry that states outright, "we do not verify individual plugins."
- Treat installing a plugin like hiring a person: Before installing, check the publisher and its permissions, and confirm the repository name is the legitimate one (impersonation defense).
- Watch for updates: Assume plugins update silently and automatically, and adopt a workflow that reviews the update diffs. Audit tools that surface those diffs are an option.
- If you're on Enterprise, turn the review on: Enable the automatic check at the entrance, but don't make it your only line of defense.
Who Holds the Reins of Convenience
The extensibility that made agents powerful is, at the same time, an entry point for attackers. This review is a reasonable step toward that reality. There are caveats, too. Its scope is limited to Enterprise and beta, and individual and Team users are still expected to fend for themselves. On top of that, because a skill's behavior changes depending on runtime context and prompts, it's hard for static malicious-content detection alone to fully guarantee safety, some point out. Automatic review is no panacea; the level-headed view is to see it as a stopgap for the transitional period until signing and verification become "a given." The more you reach for the convenience of extensions, the more the question becomes whether the operating side can keep holding the reins.
References: Claude Updates by Anthropic - August 2026 (Releasebot) / Release notes (Claude Help Center) / Marketplace Skills and Dependency Hijack in Claude Code (SentinelOne) / Hijacking Claude Code via Injected Marketplace Plugins (PromptArmor) / Malicious Coding Agent Skills and the Risk of Dynamic Context (Datadog Security Labs)
