clade-ci-integration
Warn
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's code examples in
SKILL.md(e.g.,tests/integration/claude.test.ts) reference the Node.js package@claude-ai/sdk. The official SDK for Anthropic/Claude is@anthropic-ai/sdk. Referencing an imitation or typosquatted package name is a common vector for supply chain attacks, potentially leading to the installation of malicious code if users or agents adopt the code examples without verifying the package source. - [COMMAND_EXECUTION]: The skill configuration allows the use of
Bash(npm:*)and provides instructions to runnpm ciand automated test scripts. If the project integrates the suggested@claude-ai/sdkdependency, these commands will execute code from an unverifiable and suspicious source during the CI/CD pipeline execution.
Audit Metadata