Default deny is still underrated
Prefer skills that operate in-repo with explicit paths. Be suspicious of anything that wants home-directory carte blanche “to be helpful.”
Keep .env, cloud keys, and customer exports out of contexts you paste into chats. Skills cannot leak what never enters the prompt.
Prompt injection is a product bug
If a skill fetches arbitrary web pages or tickets, treat untrusted text as hostile. Good skills isolate tool output and avoid executing instructions found inside fetched content.
When evaluating plugins, ask: does it summarize untrusted content, or does it “follow the page’s instructions”? That one answer filters a surprising amount of junk.
Team policy in one paragraph
Approved plugins only, least-privilege MCP, no production credentials in local Claude configs, and a named owner for each tool. Write it down; oral tradition fails after the second contractor.