claude-api
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the official Anthropic SDKs and related utilities via standard package registries (e.g.,
pip install anthropic,npm install @anthropic-ai/sdk,composer require anthropic-ai/sdk). These references target a well-known service and are integral to the skill's intended purpose. - [INDIRECT_PROMPT_INJECTION]: The documentation identifies and describes architectural patterns for building AI agents that ingest untrusted data from external sources (such as via the
web_search,web_fetch, andreadtools). While this introduces an indirect prompt injection surface, the skill comprehensively documents mitigation strategies, including implementing restrictive permission policies, validating inputs, and using isolated execution sandboxes. - [SAFE]: Code snippets provided for credential management use standard best practices, such as loading secrets from environment variables or dedicated vaults, and utilize benign placeholders for API keys and tokens. No malicious patterns, obfuscation, or unauthorized data access were detected.
Audit Metadata