usage-query-skill

The supplied code cannot execute as written because of a syntax error. If corrected, its substring-based URL validation could allow the authentication token to be sent to an attacker-controlled hostname when ANTHROPIC_BASE_URL is crafted accordingly. Validate the parsed hostname against an exact allowlist before issuing requests.