Default deny is still underrated
Prefer skills that operate in-repo with explicit paths. Be suspicious of anything that wants home-directory carte blanche “to be helpful.”
Keep .env, cloud keys, and customer exports out of contexts you paste into chats. Skills cannot leak what never enters the prompt.
Prompt injection is a product bug
If a skill fetches arbitrary web pages or tickets, treat untrusted text as hostile. Good skills isolate tool output and avoid executing instructions found inside fetched content.
When evaluating plugins, ask: does it summarize untrusted content, or does it follow instructions found in the page? That one answer filters a large amount of unsafe tooling.
Team policy in one paragraph
Approved plugins only, least-privilege MCP, no production credentials in local Claude configs, and a named owner for each tool. Write it down; informal policy fails after the second contractor.