clade-debug-bundle
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches service status and incident reports from Anthropic's official status API (status.anthropic.com). This is a well-known service provided by a trusted organization.\n- [COMMAND_EXECUTION]: Employs bash commands using
curlpiped topython3to process status information. The Python components are hardcoded as local command-line arguments (-m json.tooland-c "...") which are used to parse and format the downloaded JSON data, rather than executing code sourced from the network.\n- [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface for external data via the Anthropic status API. The risk is mitigated because the data is parsed as structured JSON and specific text fields are extracted before being displayed, preventing the agent from interpreting remote data as instructions.\n- [SAFE]: Instructions correctly guide the user to use environment variables ($ANTHROPIC_API_KEY) for authentication, adhering to security best practices for secret management.
Audit Metadata