glean-install-auth
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
@anthropic-ai/glean-indexing-api-clientpackage via npm. This package is managed by a well-known organization and is appropriate for the skill's stated purpose of indexing content. - [DATA_EXPOSURE]: The skill follows security best practices by instructing users to store sensitive API tokens in environment variables (a
.envfile) and explicitly warning against committing these secrets to version control. No hardcoded credentials or sensitive file paths were detected. - [INDIRECT_PROMPT_INJECTION]: The provided verification scripts ingest JSON data from Glean API endpoints at runtime. While this represents a data ingestion surface, the risk is minimal as the skill targets official service endpoints for the purpose of verifying configuration. The skill uses standard interpolation for API queries.
- [COMMAND_EXECUTION]: The skill uses standard npm and curl tools within allowed scopes to facilitate the installation and verification of the API configuration. No suspicious or high-risk command patterns were identified.
Audit Metadata