heating the forge...

@forgecat/anthropics_skills_claude-api — Security Risk Report | ForgeCat

anthropics_skills_claude-api

Security risk report for @forgecat/anthropics_skills_claude-api v0.0.4

Low

Profile is authored by Anthropic (declared in README), sourced from official Anthropic SDK repositories and documentation.
All code examples reference official Anthropic SDKs (anthropic, @anthropic-ai/sdk, com.anthropic.*, etc.) and legitimate package managers (npm, pip, Maven, Gradle, go get, gem, composer).
No typosquatted, attacker-controlled, or backdoored dependencies detected; no instructions to use non-official or suspicious packages.

Low

Content is educational documentation for the Claude API and Anthropic SDK — it teaches legitimate API usage patterns (messages, streaming, tool use, thinking, caching, managed agents) across multiple languages.
No instructions to ignore system prompts, exfiltrate credentials, read sensitive files, install remote payloads, or manipulate the AI's behavior.
Guidance on using official SDKs, proper API key handling (environment variables, not hardcoding), and standard security practices (TLS, no credential logging) is sound and security-positive.

Details

Findings

Invisible characters detected
skills/claude-api/curl/managed-agents.md · SKILL-011
Invisible characters detected
skills/claude-api/shared/managed-agents-core.md · SKILL-011
Invisible characters detected
skills/claude-api/shared/managed-agents-environments.md · SKILL-011
Invisible characters detected
skills/claude-api/shared/managed-agents-events.md · SKILL-011
Invisible characters detected
skills/claude-api/shared/managed-agents-onboarding.md · SKILL-011
Invisible characters detected
skills/claude-api/shared/managed-agents-overview.md · SKILL-011
Invisible characters detected
skills/claude-api/shared/managed-agents-tools.md · SKILL-011
Invisible characters detected
skills/claude-api/go/managed-agents/README.md · SKILL-011
Invisible characters detected
skills/claude-api/ruby/managed-agents/README.md · SKILL-011
Invisible characters detected
skills/claude-api/php/managed-agents/README.md · SKILL-011
Invisible characters detected
skills/claude-api/java/managed-agents/README.md · SKILL-011

Low

Profile is a skill (documentation + code examples) with no declared tools, hooks, or MCP servers — it has no runtime permissions to request.
When installed into Cursor/Claude Code, the skill provides read-only guidance; the AI agent decides whether to call Claude API based on user code and requests.
Authority is scoped to the stated purpose: helping developers build and debug Claude API / Anthropic SDK applications.

Details

Evidence

No tools declared in profile metadata.
No MCP servers defined.
Content is markdown documentation and code examples, not executable rules or hooks with alwaysApply/globs directives.

Low

No MCP servers are defined in the profile.
Managed agents documentation mentions MCP server integration (e.g., 'MCP Server Integration' in curl/managed-agents.md) as a feature users can configure, but the profile itself does not declare or embed any MCP server definitions.
References to MCP are instructional — showing users how to integrate external MCP servers into their own agents — not hidden instructions or arbitrary binary execution.

Details

Evidence

Profile metadata shows 'mcp_servers: (none)'.
MCP references in documentation are user-facing guidance (e.g., 'Agent declares MCP server', 'Session attaches vault containing credentials') — not embedded server configs.