zai-keys
Pass
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use
curlto interact with the Immersive Commons MCP server athttps://www.immersivecommons.com/api/mcp. These commands are used for legitimate functionality such as checking membership, listing events, and filing key requests. - [EXTERNAL_DOWNLOADS]: The
INSTALL.mdfile provides instructions to download the skill's components from the author's domain (immersivecommons.com) and recommends the installation of the@anthropic-ai/claude-codepackage from the official NPM registry, which is a well-known and trusted service. - [COMMAND_EXECUTION]: The skill provides instructions for configuring Claude Code by setting environment variables (
ANTHROPIC_BASE_URL,ANTHROPIC_AUTH_TOKEN,ANTHROPIC_MODEL,ANTHROPIC_SMALL_FAST_MODEL) and running theclaudeCLI. This is standard configuration for the intended task. - [DATA_EXFILTRATION]: The skill includes a feedback mechanism that sends diagnostic information to
https://www.immersivecommons.com/api/agent/feedbackvia a POST request. This is used for reporting errors and mismatches to the service provider.
Audit Metadata