What Claude Skills Are and How They Execute
Anthropic's Agent Skills are folders containing instructions, scripts, and resources that Claude can load dynamically during a session to perform specialized tasks. Unlike static prompt instructions, Skills can include executable code that Claude runs in a code execution environment, and they are designed to be portable across Claude apps, Claude Code, and the Claude Developer Platform API. This portability is useful for reuse, but it also means a Skill approved in one context can end up running in another with a different set of access privileges unless an organization explicitly restricts that reuse.
A Skill does not operate in isolation. Its access to enterprise data or systems is bounded by whatever tools, files, or Model Context Protocol (MCP) connections are already exposed to the Claude instance it runs in. That means the real governance question is rarely about the Skill's instructions alone, but about the execution context and the tool permissions that context already carries.
Why Skills Expand the Enterprise AI Attack Surface
Anthropic's own guidance treats untrusted Skills as comparable to installing untrusted software, because a Skill can instruct Claude to execute code rather than simply generate text. This is a meaningful distinction from prompt-based governance, which focuses on what Claude is told. Skill governance has to account for what Claude is allowed to run.
MCP adds a second trust boundary. MCP servers expose tools, resources, and prompts to Claude, and when a Skill invokes an MCP-connected tool, it inherits whatever permissions that server has been granted. If an MCP server has been configured with broad access to internal systems, a Skill calling into it can effectively exercise those same broad permissions, regardless of what the invoking user or session was intended to have. Anthropic's documentation places responsibility for the security posture of connected MCP servers on the deploying organization, not on the platform itself.
Governance Gaps Enterprises Should Expect
Several gaps are consistent across current Anthropic documentation and general AI governance frameworks like NIST's AI RMF, which calls for provenance and access-control tracking of AI system components. First, there is no single Anthropic-published enterprise permissioning model specific to Skills. Controls exist, but they are spread across Claude Code permissions, API tool-use settings, and MCP server configuration, requiring an organization to assemble its own coherent policy across all three.
Second, Skill invocation is model-driven. Claude decides when a Skill is relevant and loads it accordingly, which means governance needs visibility into when and why a Skill triggered, not just what it produced. Third, cross-context reuse creates compliance risk: the same Skill can be governed differently depending on whether it runs in a consumer app, Claude Code, or the API, absent a unified policy layer. Finally, data leakage risk increases when Skills or MCP tool calls reach enterprise data sources without data classification or DLP enforcement layered on top of Anthropic's platform controls, since that enforcement is not native to the Skill itself.
Four consistent governance gaps
No unified permissioning model across Claude Code, API, and MCP; limited visibility into why a Skill was triggered; inconsistent policy enforcement when the same Skill runs across different contexts; and no native DLP or data classification layered on top of Skill or MCP tool calls.
Building a Skill Governance Program
A practical governance program for Claude Skills should be built in stages, moving from review to enforcement to audit.
Where Runtime Enforcement Fits
Anthropic's platform controls, Trust Center documentation, and usage policies describe data handling, retention, and configuration responsibilities, but they place the burden of runtime safeguards on the deploying organization. This is the layer where runtime governance platforms are relevant: intercepting or logging the Skill-to-tool invocation point, enforcing least-privilege permissions on MCP connections, and providing tool approval workflows for actions a Skill attempts to take in production.
Trussed AI operates in this layer, providing runtime governance for enterprise AI agents, including MCP security, agent identity and permissions, tool approval workflows, and audit logging. This does not replace Anthropic's platform-level settings; it addresses the gap between those settings and the enterprise-grade visibility and control that a production deployment of Claude Skills requires.