clade-local-dev-loop
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The example script in
SKILL.mddemonstrates an interpolation pattern where user-controlled content is placed into an LLM prompt without sanitization or boundary markers.\n - Ingestion points:
src/test-prompt.ts(message content variable)\n - Boundary markers: Absent\n
- Capability inventory: Network API calls via the SDK (
client.messages.create)\n - Sanitization: Absent\n- [REMOTE_CODE_EXECUTION]: The skill instructs the user to install
@claude-ai/sdkvia npm inSKILL.md. The official Anthropic SDK for Node.js is@anthropic-ai/sdk. Installing non-standard or potentially misspelled packages from public registries can result in the execution of untrusted code.
Audit Metadata