clade-deploy-integration
Fail
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill references the Node.js package
@claude-ai/sdkin multiple code snippets. The official SDK provided by Anthropic is@anthropic-ai/sdk. This use of a non-standard package name is a classic indicator of a typosquatting attack, which could lead to the execution of malicious code during the application's deployment and runtime.- [INDIRECT_PROMPT_INJECTION]: The skill provides a mechanism for deploying code and environment variables to production platforms like Vercel, Fly.io, and Google Cloud Run. - Ingestion points: Application source code and platform configuration files.
- Boundary markers: Absent; no instructions are provided to sanitize or validate the content before it is committed to production environments.
- Capability inventory:
Bash(subcommands forvercel,fly,gcloud),Write(for creating deployment files). - Sanitization: Absent; the skill lacks validation logic to ensure that user-provided code or external data does not contain malicious instructions that would be executed upon deployment.- [METADATA_POISONING]: The skill consistently uses the term "clade" in its name (
clade-deploy-integration) and internal references (clade-observability). This misspelling of "Claude" combined with the unofficial package reference increases the risk of deception regarding the skill's official status or safety.
Recommendations
- AI detected serious security threats
Audit Metadata