claude-api
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading official Anthropic SDKs and the Anthropic CLI from trusted sources, including GitHub releases, PyPI, npm, Maven Central, and Packagist.
- [COMMAND_EXECUTION]: Installation guides in
shared/anthropic-cli.mdinclude standard shell commands for installing the CLI using package managers like Homebrew or via direct binary download and extraction usingcurlandtarfrom official GitHub repositories. - [PROMPT_INJECTION]: Documentation in
shared/evals/build-eval.mdincludes guidance for maintaining a concise AI output style. Static analysis flagged this as an attempt to conceal actions, but in context, it is benign instructional content designed to improve user experience in a developer-focused tool by reducing verbosity. - [DATA_EXFILTRATION]: Diagnostic scripts such as
shared/evals/report/build-report-lite.mjsandshared/evals/report/runner-scaffold.mjsimplement explicit defensive programming by validating file paths and refusing to follow symbolic links. These measures are designed to prevent accidental or malicious access to sensitive system files like SSH keys or environment secrets.
Audit Metadata