⏱ If there's time — Skill security

A skill is code and resources that Claude runs on your behalf. That makes it powerful —and a risk vector if you handle it carelessly. Two rules cover most of the risk.

Rule 1 — Never put secrets inside a skill

Don’t embed API keys, passwords, or tokens in the SKILL.md, in the scripts, or in the resources. A skill is shared and packaged into a ZIP: any secret you write inside travels with it to your whole team (and anyone who receives the file).

• Keep credentials outside the skill: environment variables, a managed connector, or your organization’s secrets manager.
• Before packaging, review the skill’s contents and confirm no sensitive string was left pasted in “just for testing”.

Rule 2 — Review third-party skills before enabling them

When you install a skill you didn’t create (from a colleague, a plugin, or a repository), read it before turning it on:

• Open the SKILL.md and the scripts: understand what it does and which resources it touches.
• Be wary of skills that request broad permissions or run code you don’t recognize.
• On Enterprise, Skill activation is governed by the Owner in Organization settings > Skills: lean on that control layer.

✅ Checkpoint

You can name the two habits —zero embedded secrets and review third-party skills before enabling— and explain why they matter when a skill is shared by ZIP across the whole team.

Workshop Claude Avanzado · Grupo Salinas · v1.0 · 2026