Query Concatenation

In SQL statement use placeholders instead of variable: %s (string) or %d (number).
The second argument of prepare() is array of variables to substitute into the placeholders.

$skill_select = $wpdb->get_results(
                $wpdb->prepare("
            SELECT skill_name, char_id, um_id, c.class_id
            FROM `wp_ml_skill_class` sc
            JOIN `wp_ml_skill` s ON (s.skill_id = sc.skill_id)
            JOIN `wp_ml_character` c
            WHERE c.class_id = %d AND c.char_id = %d",
            [$convert_class_id, $convert_char_id]));