Skills for enterprise

Governance, security review, evaluation, and organizational guidance for deploying Agent Skills at enterprise scale.

This guide is for enterprise admins and architects who need to govern Agent Skills across an organization. It covers how to vet, evaluate, deploy, and manage Skills at scale. For authoring guidance, see best practices. For architecture details, see the Skills overview.

Security review and vetting

Deploying Skills in an enterprise requires answering two distinct questions:

Are Skills safe in general? See the security considerations section in the overview for platform-level security details.
How do I vet a specific Skill? Use the following risk assessment and review checklist.

Risk tier assessment

Evaluate each Skill against these risk indicators before approving deployment:

Risk indicator	What to look for	Concern level
Code execution	Scripts in the Skill directory (`.py`, `.sh`, `*.js`)	High: scripts run with full environment access
Instruction manipulation	Directives to ignore safety rules, hide actions from users, or alter Claude's behavior conditionally	High: can bypass security controls
MCP server references	Instructions referencing MCP tools (

Security review and vetting

Risk tier assessment

Security review and vetting

Risk tier assessment