claude-api
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- Trusted Vendor Dependencies: The skill provides instructions and examples for installing official SDKs and CLI tools from Anthropic across various ecosystems (Python, Node.js, Go, etc.). These originate from trusted developer organizations and are safe for integration.
- Benign UX Guidelines: The evaluation and onboarding guides contain instructions for the AI agent to minimize 'internal bookkeeping' output to the user. While identified by heuristic scanners as potential action concealment, these are stylistic constraints designed to provide a concise and focused user experience rather than to bypass safety protocols.
- Security-Hardened Utility Scripts: The skill includes utility scripts (
prefix_diff.py,drop_block_probe.py,build-report-lite.mjs) for conversation auditing and report generation. These scripts incorporate deliberate security features, such as symbolic link and hard link checks to prevent path traversal, and the stripping of terminal control sequences from outputs to mitigate potential hijacking or log forgery. - Safe Credential Practices: The documentation explicitly advocates for and demonstrates the use of environment variables and secure vault storage for API keys and tokens. All credentials shown in the README files are clearly marked as example placeholders, and the included CLI tools use standardized, user-controlled local configuration paths.
Audit Metadata