claude-api

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading official Anthropic SDKs and the Anthropic CLI from trusted sources, including GitHub releases, PyPI, npm, Maven Central, and Packagist.
  • [COMMAND_EXECUTION]: Installation guides in shared/anthropic-cli.md include standard shell commands for installing the CLI using package managers like Homebrew or via direct binary download and extraction using curl and tar from official GitHub repositories.
  • [PROMPT_INJECTION]: Documentation in shared/evals/build-eval.md includes guidance for maintaining a concise AI output style. Static analysis flagged this as an attempt to conceal actions, but in context, it is benign instructional content designed to improve user experience in a developer-focused tool by reducing verbosity.
  • [DATA_EXFILTRATION]: Diagnostic scripts such as shared/evals/report/build-report-lite.mjs and shared/evals/report/runner-scaffold.mjs implement explicit defensive programming by validating file paths and refusing to follow symbolic links. These measures are designed to prevent accidental or malicious access to sensitive system files like SSH keys or environment secrets.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 07:14 PM