Are Claude Code mods safe?

Unlike a skill (a markdown file Claude reads), a mod is a TypeScript function that hooks into Claude Code's engine. It can rewrite your prompt, approve or deny tool calls, run shell commands, read and write your files, and draw its own UI. Anthropic's own docs put it plainly: mods run with Claude Code's full access, outside any sandbox.

That doesn't make every mod dangerous — most do narrow, useful things. But it means "safe" is never a property of the format. It's a property of what this specific mod touches: does it reach the network? read files outside your project? shell out? That's the question our reviews try to answer, mod by mod.

If mod safety were just us being cautious, Anthropic wouldn't keep patching the same attack surface. In 2.1.288 alone, the official changelog lists two permission-bypass fixes:

1. A dangerous rm slipping past the prompt. A destructive remove — say, on / or your home directory — wrapped in bash -c / sh -c could run without asking in bypass-permissions mode or under a shell allow rule. That's now fixed (anthropics/claude-code#96300).
2. Safety hooks silently skipped. PreToolUse and PermissionRequest hooks — the interception points that gate tool calls — were skipped entirely when matching them failed or a tool's input couldn't be serialized to JSON. A skipped hook is a bypassed guardrail. They now fail closed: the call is blocked instead.

Read that second one twice. The hooks whose whole job is to stand between a tool call and your machine could vanish without a sound — and everything would proceed as if they'd approved. Any mod acting as a safety guardrail depended on those hooks working.

The lesson isn't "Claude Code is broken" — it's that the permission layer is an active battleground, patched release by release. You can't outsource the whole safety question to it. Before installing any mod, ask three things:

1. What does it touch? Network, filesystem, shell, credentials — the narrower, the better.
2. What leaves your machine? "Not stored" is not the same as "not sent." Our reviews flag this explicitly.
3. Who vouches for it? A scan tells you what a mod can reach. A human verdict tells you how it reaches it — and whether that's reasonable.