anthropic-claude-code-surfaces
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents standard terminal commands for the user to install and configure Claude Code, including the use of
sudoandaptfor the Linux Desktop application setup. - [EXTERNAL_DOWNLOADS]: The documentation references downloading official signing keys and repository configurations from the trusted domain
downloads.claude.aiand provides instructions for connecting to well-known service endpoints like GitHub. - [INDIRECT_PROMPT_INJECTION]: The skill documents an existing platform feature where the web interface can ingest prompt text from an external source via a
prompt_urlquery parameter. This is reported as a feature description of the service rather than a vulnerability in the skill itself.
Audit Metadata