claude-api

AI Security Review

Evidence context: threat category none; evidence quality strong.

This item is not a browser extension. It is a reference skill document named "claude-api" published by "anthropics" in a skills marketplace. The description states it covers model ids, pricing, params, streaming, tool use, MCP, agents, caching, token counting, and model migration for the Claude API and Anthropic SDK. The store field is "skills", permissions and host_permissions are both empty arrays, and the version string "317b8b501b6a" resembles a git commit hash rather than a semantic version.

The two critical-severity findings carry the title "SKILL-CREDENTIAL-ACCESS-SKILL.md" and point to lines 234 and 481 of a file named SKILL.md. SKILL.md is a markdown documentation file. It contains no executable JavaScript or WebAssembly. The finding title indicates a YARA rule for credential access patterns matched text within API documentation. Documentation for any API that requires authentication will necessarily discuss credentials, API keys, and token handling. A rule designed to detect credential theft in executable code will produce false positives when run against prose that explains how to authenticate with an API.

The 230 IoC findings and 319 code-smell findings follow the same pattern. The network endpoints list includes anthropic.ai, claude.ai, and api.twilio.com alongside entries like agent.tools, client.new, client.post, and budget.total. These are not network connections. They are SDK method names and example domains extracted from code samples embedded in the documentation. The IoC extractor parsed code blocks in markdown as if they were live network activity. The code-smell rules fired on the same code examples, which reference environment variables, API keys, and file operations because that is what API documentation demonstrates.

Zero malware signatures matched. There is no executable payload, no obfuscated code, no suspicious domains outside the Anthropic ecosystem and standard third-party services mentioned in examples. The publisher is "anthropics", the legitimate developer of Claude.

A skeptic might point to the two critical tool-poisoning findings and argue that credential access in a skill document warrants investigation. The counterargument collapses when you examine what SKILL.md actually is. It is a markdown reference file with no executable capability. It cannot exfiltrate credentials because it cannot execute. The YARA rule matched on the word patterns around authentication documentation. It did not match on code that reads browser cookies or intercepts login forms. The finding severity is inherited from the rule default weight, not from actual risk in this context.

Key Reasons

• Item is a markdown documentation file (SKILL.md), not executable code
• Publisher is anthropics, the legitimate developer of Claude
• Tool-poisoning findings matched documentation text about API authentication
• IoCs are SDK method names and example domains from code samples, not live connections
• Zero malware signatures matched, no executable payload present

False Positive Considerations

• SKILL.md is documentation, not executable code
• IoC extractor parsed code examples in markdown as network activity
• Code-smell rules matched code samples demonstrating API usage
• Tool-poisoning rule matched prose about credential and authentication handling

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 95%.