clade-migration-deep-dive
Warn
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONMETADATA_POISONING
Full Analysis
- [EXTERNAL_DOWNLOADS]: The instruction set in
SKILL.mdincludes code snippets that import and use a non-standard Node.js package@claude-ai/sdk. The official Anthropic SDK is published as@anthropic-ai/sdk. Directing users to install and import an unofficial package creates a supply chain risk where a malicious actor could register the incorrect name to execute code on the user's system. - [REMOTE_CODE_EXECUTION]: By recommending the installation and import of the
@claude-ai/sdkpackage, the skill facilitates the potential execution of untrusted code if the user follows the provided examples in their development environment. - [METADATA_POISONING]: The skill consistently uses the term 'clade' instead of 'claude' in its name (
clade-migration-deep-dive) and internal references (clade-common-errors,clade-sdk-patterns). While the description acknowledges 'Claude', the persistent use of the misspelling in identifiers and package names increases the likelihood of users copying and using incorrect, potentially unsafe identifiers.
Audit Metadata