Claude Skills for Enterprise: Which to Trust

A skill your team uploads through the Claude API is never security-scanned, and if your production agents call it without a pinned version, anyone in the workspace can change what they run. That is the part of Claude skills for enterprise most rollout plans miss. By the end of this post you will know which skills are worth deploying, which to build yourself, and the review and versioning process a skill needs before it touches your data.

The short list is genuinely short. As of November 2026, the skills worth rolling out company-wide are Anthropic's four document skills (Word, Excel, PowerPoint, PDF) and a handful from its open-source repository. Everything else that matters will be a narrow skill you write about your own workflows, and the governance around those is where the real work sits.

Which Claude skills are worth deploying across a company?

Anthropic's pre-built Agent Skills cover four document formats: pptx, xlsx, docx and pdf. On the API you reference them by those short IDs; in claude.ai they are active when you create documents, with no setup. They are not available pre-built in Claude Code, though the same four ship in the anthropics/skills repository, which Anthropic describes as the skills that power Claude's document capabilities "in a production AI application", released under Apache 2.0. Claude Code users can install them with /plugin install document-skills@anthropic-agent-skills.

The repository holds 19 skill folders as of this month. We read each one's SKILL.md. Most are demonstrations; a few earn a place in a business rollout:

Skill	What it does	Our verdict for a 50-500 person company
docx, xlsx, pptx, pdf	Create, read and edit Word, Excel and PowerPoint files; extract, merge, split, fill forms and OCR PDFs	Deploy. These are the best Anthropic skills for business documents, and Anthropic says they power Claude's own document features.
skill-creator	Drafts new skills, runs test prompts and evals, and tunes a skill's description for triggering accuracy	Deploy to the people who will author internal skills.
internal-comms	Status reports, leadership updates, 3P updates, newsletters and incident reports from example files	Fork it. The value is replacing its examples with your own formats.
mcp-builder	Guidance for building MCP servers in Python (FastMCP) or Node/TypeScript	Engineering teams only.
webapp-testing	Drives local web apps with Playwright, captures screenshots and browser logs	Engineering teams only.
doc-coauthoring	A structured workflow for proposals, specs and decision docs	Optional, for teams that write long documents.
claude-api	Current API reference and SDK guidance for eight languages	Already bundled with Claude Code; no action needed.

Skip the rest for a company-wide rollout: algorithmic-art, slack-gif-creator, canvas-design and theme-factory are creative demos, and brand-guidelines applies Anthropic's own brand, so it is only useful as a template for yours. The repository's own README says the skills are "provided for demonstration and educational purposes only" and tells you to test them before relying on them for critical tasks. Take that at face value for everything outside the four document skills.

Beyond Anthropic, the skills directory Anthropic announced on December 18, 2025 lists partner-built skills from Notion, Canva, Figma, Atlassian and others. Treat a partner skill the way you treat that vendor's integration: useful if you already run the tool, and still subject to the review below.

Claude skills for enterprise do not sync between claude.ai, the API and Claude Code

Custom skills do not sync across surfaces. Anthropic's docs are blunt: skills uploaded to claude.ai must be separately uploaded to the API, API skills are not available in claude.ai, and Claude Code skills are filesystem-based and separate from both. One skill used in all three places is three deployments, each managed on its own.

Each surface also shares skills differently and runs them under different rules:

Surface	How a skill reaches people	Network access when it runs
claude.ai	Users upload zip files; Team and Enterprise admins can provision skills centrally, enabled by default for all users	Full, partial or none, depending on user and admin settings
Claude API	Uploaded through /v1/skills; available to every member of the workspace	None, and no runtime package installation
Claude Code	Personal (~/.claude/skills/), project (.claude/skills/), plugins, or the enterprise managed settings directory	Same as any program on the user's machine

The admin provisioning in claude.ai came with the December 2025 organization skills release, which also published Agent Skills as an open standard at agentskills.io. In Claude Code, an enterprise skill in the managed settings directory beats a personal one, and a personal one beats a project one with the same name. That precedence is useful: a skill IT controls cannot be shadowed by a copy in a repo.

The Claude Code row is the one to watch. A skill there runs with the developer's own network access and files, and developer machines are where secrets already leak; we traced one route in how passwords reached GitHub through Claude Code settings. Anthropic's advice is to keep skill source files in Git as the single source of truth and build your own sync to each surface. That sync job is yours to build; nothing ships it.

Claude skills API version pinning decides who controls production

An unpinned skill in an API request runs whatever version was uploaded last. Anthropic's enterprise guide says it directly: "If you omit version, requests use the latest version, so a new version uploaded by anyone in the workspace immediately changes what production agents run." Since API skills are workspace-wide, "anyone" means every workspace member.

The fix is in the request. Anthropic skills take date-based versions such as 20251013; custom skills take generated IDs such as skver_01...; both accept latest, per the Skills API guide. Pin production to an explicit version, keep latest for development, and keep the previous version ready as a rollback. Anthropic also recommends checksums of reviewed skills verified at deploy time and signed commits in the skill repository.

How many skills can Claude use at once?

A single API request can include up to 20 skills. The practical ceiling is often lower. Each skill's name and description sit in the system prompt at roughly 100 tokens each, and Anthropic warns that with too many active, Claude may pick the wrong skill or miss the right one. Its suggested pattern is role-based bundles (sales, engineering, finance), each loading only what that role uses, and routing requests to different skill sets when a role needs more than 20.

The API also does not report which skills ran: Anthropic notes that usage analytics are not currently available through the Skills API, so log the skill IDs and versions in each request yourself. Without that log, a version change is invisible after the fact.

Are third-party Claude skills safe to install?

Third-party skills should be treated as untrusted code until someone has read every file. Anthropic says to use skills only from trusted sources: those you created yourself or obtained from Anthropic, because a malicious skill can direct Claude to run code or call tools in ways that do not match its stated purpose.

Anthropic does offer a scanner, with gaps. Claude Enterprise organizations can turn on Skill and plugin security scanning for skills uploaded or edited in claude.ai and Cowork. Failed and unfinished scans block the skill. But scanning does not cover the Claude API: skills uploaded through /v1/skills or the Console are not scanned. It also skips skills already in the organization when you turn it on, and organizations with customer-managed keys, zero data retention or HIPAA readiness. The production path, the API, is the unscanned one.

How bad is the open marketplace? Snyk's ToxicSkills study, published February 5, 2026, scanned 3,984 skills from ClawHub and skills.sh and reported that 13.4% (534) had at least one critical-level issue, with 76 confirmed malicious after human review and eight still live on ClawHub at publication. Snyk sells AI security products, Evo among them, and the post closes by pitching them, so read the rate as a vendor's measurement.

The strongest counter-argument comes from academic research. Holzbauer et al. (arXiv 2603.16572) analyzed 238,180 skills and argue that marketplace scanners judge skills in isolation and overstate risk, with marketplace scanner reports classifying up to 46.8% of skills as malicious. Re-checking 2,887 scanner-flagged skill-repository combinations against their GitHub context, they found only 15 (0.52%) remained suspicious. The same paper found 121 skills pointing to seven abandoned repositories that could be hijacked.

Both can be true. Headline malicious rates are soft, and the attack paths are real: a skill whose upstream repository changes hands, or one that fetches instructions from a URL, can turn bad after you approved it. Anthropic flags exactly this, warning that even trustworthy skills can be compromised if their external dependencies change. We saw the same trust-the-package failure in the Postman Claude plugin hook that trusted itself.

A Claude skills security review checklist

Anthropic's enterprise review checklist is the right baseline, and it applies to internal contributors as much as to marketplace downloads:

1. Read every file in the skill directory: SKILL.md, referenced markdown and bundled scripts.
2. Run scripts in a sandbox and confirm they do what the description says. Anthropic rates bundled *.py, *.sh and *.js as high concern because they run with full environment access.
3. Look for adversarial instructions: ignoring safety rules, hiding actions, or behaving differently on specific inputs.
4. Search for network calls (http, requests.get, curl, fetch) and check every URL points where you expect.
5. Reject hardcoded API keys, tokens or passwords.
6. List every tool, bash command and MCP reference, and weigh file-read plus network access together.
7. Check for exfiltration patterns, including data encoded into Claude's own responses.

Add one rule the checklist implies: the author of a skill does not approve it. Anthropic's lifecycle guidance calls for separation of duties, and treats every version update as a new deployment that needs the full review. Also note that Agent Skills are not eligible for zero data retention; skill definitions and execution data follow Anthropic's standard retention, which matters if your legal team signed off on ZDR for the rest of your API use.

Should you build custom Claude skills or use marketplace skills?

Build narrow custom Claude skills for your own workflows; install only Anthropic's document skills and partner skills for tools you already run. That is our position, and the case against it deserves its strongest form first.

Marketplace skills are free, already written, and some are good. Writing your own takes engineering time, needs an evaluation suite, and creates something to maintain when models change. If a well-reviewed public skill does the job, building a copy is waste, the same trade-off we laid out in which SaaS layers to own when you build vs buy.

The answer is that a skill's value is the organizational knowledge in it: your report formats, your CRM fields, your approval rules. No public skill has those. Anthropic's own guidance points the same way: start with narrow, workflow-specific skills such as formatting-sales-reports or updating-crm-records, then consolidate into broader ones only when evaluations confirm equal performance. It asks for 3-5 representative test queries per skill, covering should-trigger, should-not-trigger and edge cases, tested on each model you use.

Building is the wrong choice if no one will own the skill. Anthropic expects each skill in an internal registry with a purpose, owner, version, dependencies and last evaluation date. If you cannot name the owner, stay on the pre-built skills until you can. Governance of who can author and publish matters as much as the code, a point we made about citizen developer governance after Goldman pulled Claude Code.

Where to start with custom skills you can govern

Put the first month into three moves: approve the four document skills, stand up a Git repository as the source of truth with a review rule that the author cannot merge their own skill, and pin every skill version in API requests before any agent reaches production data. Then pick one repetitive workflow and write a narrow skill with its evaluation suite. That order gets value out early without letting an unreviewed upload change what a production agent does.

Claude and agentic development on the Anthropic API are part of the stack we build with. If you are deciding which internal workflows deserve a custom skill, or need the sync, version pinning and request logging built around the API before your first skill-driven agent ships, our AI engineering team can scope the skill set and the governance pipeline with you.