claude-agent-sdk
Warn
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The file
templates/custom-mcp-server.tsincludes acalculatetool implementation that uses the JavaScripteval()function to process expression strings provided by the agent. While the template includes a warning comment advising the use of a proper math parser for production, the inclusion ofeval()with direct input from the agent represents a significant security risk for arbitrary code execution if developers copy the code verbatim. - [EXTERNAL_DOWNLOADS]: The documentation and setup scripts (
SKILL.md,scripts/check-versions.sh, andtemplates/package.json) reference the installation of several external dependencies from the official npm registry, including@anthropic-ai/claude-agent-sdk,@anthropic-ai/claude-code, andzod. These downloads originate from official sources and are documented as required for the SDK's functionality.
Audit Metadata