Bash Appears in 1% of Skills. Read and Write Appear in a Quarter.

If you assumed agent skills were mostly about executing things, the tool references say otherwise.

Counting explicit mentions of Claude Code tool names across 765 SKILL.md files:

Read and Write together appear in nearly half the corpus. Bash — the tool that actually executes things — appears in eight files.

What this says about the ecosystem

The dominant skill is a document transformer: read something, produce something. Contracts, decks, reports, summaries, images, videos. The tooling reflects the task.

That matches the category distribution: documents, marketing, writing, and design together are a large share of the directory, and all of them are read-and-produce work. Developer-tools skills are numerous but mostly advise rather than execute.

It also explains why security findings cluster where they do. A skill that never runs a command has a small attack surface; the interesting risk is in the 8 Bash skills and the 31 that mention curl.

The dangerous commands, in context

Scanning for obviously risky strings:

Three files contain rm -rf. Ten use base64, which is often legitimate encoding work and occasionally obfuscation. Thirty-one mention curl, which is the normal way a skill talks to an API.

None of these are automatically bad — the security dimension is scored on context, not on string matching. But they are where a reviewer should look first, and there are few enough of them to check by hand.

The takeaway for skill authors

If your skill only needs Read and Write, say so explicitly. A capability manifest that matches the work is a security feature: it tells the reviewer what to expect.

If your skill needs Bash, the description should say what it will run — and the workflow should have a confirmation gate before anything destructive. Only 14 skills in the corpus have one.