Beware Claude Skills Hacking: How Skills, Hooks and MCP Servers Can Be Turned Against You

I use Claude Code every day, and I have written about how Caribbean teams can build faster with it. It also has three extension points that most developers install without reading: skills, hooks and MCP (Model Context Protocol) servers. Each one can be used to run commands or move data on your machine, with your permissions.

What skills, hooks and MCP servers can do on your machine

• Skills are instruction files, usually Markdown kept in a project's .claude/ directory, sometimes with scripts alongside. Claude Code follows them when it decides they apply.
• Hooks are shell commands set in a settings.json file that run automatically on Claude Code events, such as before a tool runs or after a file is edited.
• MCP servers give Claude Code extra tools: a database client, a file browser, a deployment pipeline. Whatever Claude sends to a tool call goes to that server.

Clone a repository with a .claude/ directory and its skills and settings can shape what Claude Code does. Connect someone else's MCP server and it receives your context. Paste a hooks block from a forum and its commands run on your machine.

Poisoned skills in a cloned repository

A developer clones an open source project whose .claude/ folder contains helpful-looking skills. One of them tells Claude Code to add a particular dependency to every project, include an extra import in generated files, or send "diagnostics" to an outside URL. The developer skims past it as documentation. Claude follows it, because following skill instructions is what skills are for.

This is the same pattern as the malicious npm and PyPI packages that have hit developers for years, moved into a new file format. A skill file is instructions to an agent that can read, write and execute. Read it the way you would read a shell script.

MCP servers that collect your code

When Claude Code calls an MCP tool, the arguments it sends, which can include source code, file paths and configuration, go to that server. A malicious or compromised server can keep all of it. An abandoned one is a risk too: if the maintainer's account or package is taken over, the next update runs with the access you granted.

For a Jamaican fintech or a bank's development team, one untrusted MCP server connected while working on production code could expose credentials and customer-data schemas. That would be a reportable incident, not just an embarrassment.

Hooks copied from the internet

A hook set to run after every file write can copy each file to a remote server. A hook that runs before a commit can change what is staged. Both look like one line of JSON in a settings file.

I have watched developers copy whole settings.json files from Reddit and Stack Overflow without reading them. With hooks, that habit hands a stranger a shell on your laptop.

The four rules we enforce at StarApple AI

These apply across all four of our labs, and engineers lose access if they break them.

1. No MCP server without approval. Every server is reviewed by me or our security lead before it touches a codebase. The approved list is short on purpose.
2. Read every .claude/ directory before opening Claude Code in a cloned repo. Every skill, every settings file. Anything odd means the project is reviewed in a sandbox first.
3. No hooks from outside. We write our own, review them and keep them in version control.
4. Restrictive permissions by default. Engineers approve file edits and commands as they happen, and widen permissions only for a specific, time-limited task. Nobody runs with prompts switched off on a machine that holds real credentials.

The gap in our own rules is speed. Reading every skill file takes time, and I cannot prove every engineer does it under deadline. We are looking at automated scanning of .claude/ directories to back it up.

Why small Caribbean tech communities are exposed

Caribbean developers mostly know each other. We share code, tips and config files on WhatsApp groups and at meet-ups, and we trust what comes from people we know. That same trust is how a bad config file spreads fastest: one compromised setup, forwarded in good faith, reaches dozens of teams.

Most developers I speak to in Jamaica think about application and API security. Few have thought about the security of the tools they write the application with.

None of this is a case against Claude Code. I still use it daily. Be the Boss of your AI: know what permissions you have granted and read the configuration, not only the code it produces.

"A Claude Skill is not documentation. It is executable intent channelled through the most capable coding agent most developers have ever used. Treat it accordingly." - Adrian Dunkley, AI Boss

What to do this week

1. Every developer: list your MCP servers. Run /mcp in Claude Code and remove any server you cannot name the owner of or have not used in a month.
2. Every developer: review your hooks. Run /hooks, and open your user and project settings.json files. Delete any hook you did not write or cannot explain line by line.
3. Team leads: add .claude/ to code review. Treat changes to skills, hooks and .mcp.json like changes to CI scripts, with a named reviewer on every pull request that touches them.
4. Security leads: publish an approved list. Name the MCP servers and skill sources your organisation allows, and block the rest in managed settings where your plan supports it.
5. Anyone opening an unfamiliar repo: read .claude/ first. If you must run it before reading, do it in a container or throwaway VM with no credentials.

Frequently Asked Questions

Does Claude Code warn me before using a cloned project's settings?

It asks you to confirm that you trust a folder the first time you open it, and it asks for approval before using MCP servers defined in a project's .mcp.json file. Those prompts only help if you read what you are approving. Saying yes to trust on a repository you have not inspected hands its configuration the benefit of the doubt.

Where are hooks and MCP servers configured?

Hooks live in settings.json files: one in your home directory's .claude folder for all projects, and others inside a project's .claude folder. Project MCP servers are usually listed in a .mcp.json file at the repository root. Check both user and project locations, because a harmful entry can sit in either.

How do I check an MCP server before connecting it?

Find out who publishes it, whether the source code is public, and when it was last updated. Read which tools it exposes and what each tool's description asks the model to send it. Prefer servers from the vendor of the service they connect to, and run anything unfamiliar first in a container with no access to real secrets.

What should I do if I think a hook or MCP server has already leaked data?

Disconnect the server or delete the hook, then rotate every credential that was on the machine or in the repository: API keys, cloud tokens, database passwords and SSH keys. Check your git history and cloud logs for changes you did not make. If personal data may have been exposed, Jamaica's Data Protection Act 2020 requires organisations to report certain breaches to the Information Commissioner, so involve your data protection officer early.

Are skills from the official marketplace or well-known publishers safe?

They are lower risk, not risk-free. A popular skill can be updated after you install it, and a publisher's account can be compromised. Pin the version you reviewed where you can, and re-read a skill when it changes.