Is claude-api safe to install?

SaferSkills independently audited claude-api (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/claude-api/SKILL.md · 1 file

skills/claude-api/SKILL.md2.4 KB · Markdown

name: claude-api

description: Load when a workflow-router-selected owner workflow needs Claude API or Anthropic SDK build, debug, migration, or tuning work; skip provider-neutral, OpenAI, or non-Anthropic model work.

license: Complete terms in LICENSE.txt

metadata:

source: "anthropics/skills skills/claude-api"

upstream_commit: "690f15cac7f7b4c055c5ab109c79ed9259934081"

adaptation: "Slim platform-neutral routing and source lookup; volatile API tables are not copied."

Claude API

Use this skill for provider-specific Claude API and Anthropic SDK work. Keep it explicit: if the target file is provider-neutral or already uses another provider, stop and ask whether the user wants an Anthropic-specific implementation.

Workflow

Detect the project language, runtime, and existing SDK usage.
Read references/live-sources.md, then verify current Anthropic docs or SDK source before relying on API names, model IDs, headers, beta flags, or migration details that may have changed.
Prefer the official Anthropic SDK for the project language. Use raw HTTP only when the user asks for REST/cURL or no suitable SDK exists.
Keep secrets in environment variables or the target repo's existing secret manager. Never place API keys, tokens, or credentials in prompts, committed files, examples, or logs.
Preserve existing provider boundaries. Do not introduce Anthropic SDK calls into OpenAI, generic, or multi-provider files unless the accepted change is to add an Anthropic lane.
Run the nearest compile, typecheck, unit, or smoke check after changing code.

Implementation Checks

Confirm exact package names, imports, client constructors, method names, request fields, streaming helpers, and response shapes from current docs or SDK source.
Treat model names, pricing, context windows, rate limits, prompt caching behavior, and migration guidance as live facts.
Make cost, latency, timeout, and retry tradeoffs explicit when changing generation behavior.
Add tests or fixtures around request construction, response parsing, and error handling where the project already has a test surface.

Boundaries

Use documentation-lookup for general API/library questions that are not Anthropic-specific.
Use mcp-builder for MCP server design or tool schemas.
Use security-review when auth, secret handling, sandboxing, or untrusted tool execution is central.

claude-api— agent skill

Is claude-api safe to install?

Claude API

Workflow

Implementation Checks

Boundaries

Audit the pieces. Scan the whole. Decide.