clade-install-auth
Fail
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONMETADATA_POISONING
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install
@claude-ai/sdkvia npm. The official, verified Node.js SDK provided by Anthropic is@anthropic-ai/sdk. The use of a similar-sounding but unofficial package name is a hallmark of typosquatting attacks intended to trick users into downloading unauthorized software. - [REMOTE_CODE_EXECUTION]: By encouraging the execution of
npm install @claude-ai/sdk, the skill enables the execution of any arbitrary code contained within the package's lifecycle scripts (such aspreinstallorpostinstall) on the host system. - [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to perform package manager installations of unofficial third-party libraries, providing a vector for system compromise through malicious dependencies. - [METADATA_POISONING]: The skill consistently misspellls 'Claude' as 'clade' in its name (
clade-install-auth), description, and next-step references. This deceptive or low-quality naming can lead users to misjudge the safety and official nature of the integration.
Recommendations
- AI detected serious security threats
Audit Metadata