claude-api
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation includes numerous references to official documentation and source repositories on platform.claude.com and GitHub. These targets (Claude, Anthropic) are recognized as trusted organizations providing authoritative information on the described APIs and SDKs.
- [COMMAND_EXECUTION]: Documentation for the Agent SDK describes a built-in Bash tool and support for Model Context Protocol (MCP) servers, both of which enable the execution of shell commands and external processes. These are documented features intended for creating autonomous coding agents in a developer environment.
- [REMOTE_CODE_EXECUTION]: The skill provides detailed instructions on using Anthropic's server-side code execution tool, which allows the model to run Python code in a secure sandboxed container. This is a standard API feature used for data analysis and processing.
- [DATA_EXFILTRATION]: The skill describes capabilities such as WebSearch, WebFetch, and local file system access (Read, Write, Edit). While these tools enable data movement between the local workspace and external networks, they are core components of the Agent SDK's functionality for information retrieval and task automation.
- [PROMPT_INJECTION]: The skill contains architectural guidance for building agents that ingest data from external sources (web pages, user-uploaded files). It identifies the security implications of processing untrusted data and provides mitigation strategies such as structured output validation, explicit permission modes, and filename sanitization.
Audit Metadata