claude-light
Warn
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill instructions in SKILL.md and QUICK_REFERENCE.md provide code snippets that utilize 'pickle.load()' for caching experimental results retrieved from 'https://claude-light.cheme.cmu.edu/api'. Using 'pickle' to deserialize data originating from external or remote sources is a security risk as it can be exploited to achieve arbitrary code execution.
- [EXTERNAL_DOWNLOADS]: The skill communicates with an external API at 'https://claude-light.cheme.cmu.edu/api' to perform experiments and collect spectral data. This communication is the primary purpose of the skill and targets a reputable educational domain, but it represents an external data dependency.
Audit Metadata