zai-keys

Pass

Audited by Gen Agent Trust Hub on Jul 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use curl to interact with the Immersive Commons MCP server at https://www.immersivecommons.com/api/mcp. These commands are used for legitimate functionality such as checking membership, listing events, and filing key requests.
  • [EXTERNAL_DOWNLOADS]: The INSTALL.md file provides instructions to download the skill's components from the author's domain (immersivecommons.com) and recommends the installation of the @anthropic-ai/claude-code package from the official NPM registry, which is a well-known and trusted service.
  • [COMMAND_EXECUTION]: The skill provides instructions for configuring Claude Code by setting environment variables (ANTHROPIC_BASE_URL, ANTHROPIC_AUTH_TOKEN, ANTHROPIC_MODEL, ANTHROPIC_SMALL_FAST_MODEL) and running the claude CLI. This is standard configuration for the intended task.
  • [DATA_EXFILTRATION]: The skill includes a feedback mechanism that sends diagnostic information to https://www.immersivecommons.com/api/agent/feedback via a POST request. This is used for reporting errors and mismatches to the service provider.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 19, 2026, 10:23 PM
Security Audit — agent-trust-hub — zai-keys