Request review
B

Is claude-api safe?

anthropics/skills · scanned Oct 4, 2026

What it says it does

Reference for the Claude API / Anthropic SDK — model ids, pricing, params, streaming, tool use, MCP, agents, caching, token counting, model migration. TRIGGER — read BEFORE opening the target file; don't skip because it "looks like a one-liner" — whenever: the prompt names Claude/Anthropic in any form (Claude, Anthropic, Fable, Opus, Sonnet, Haiku, `anthropic`, `@anthropic-ai`, `claude-*`, `us.anthropic.*`, `[1m]`); the user asks about an LLM (pricing/model choice/limits/caching) — never answer from memory; OR the task is LLM-shaped with provider unstated (agent/MCP/tool-definition/multi-agent/RAG/LLM-judge/computer-use; generate/summarize/extract/classify/rewrite/converse over NL; debugging refusals/cutoffs/streaming/tool-calls/tokens). SKIP only when another provider is being worked on (overrides all triggers): OpenAI/GPT/Gemini/Llama/Mistral/Cohere/Ollama named in the query; OR `grep -rE 'openai|langchain_openai|google.generativeai|genai|mistralai|cohere|ollama'` over the project hits (run this grep FIRST if no provider named — don't Read the file).

B
Score 88/100

Some patterns deserve a look before you install.

Medium · 3
Source
Repository
anthropics/skills/skills/claude-api
Commit
8a1541c4a3ff
Scanned
Oct 4, 2026
Files checked
40
Stars
180k
License
None declared
Last push
Oct 3, 2026
What it can reach
External domains mentioned anywhere in the skill's files.
api.anthropic.comapi.githubcopilot.comaws.amazon.comcloud.google.comexample.comgithub.commcp.slack.commodelcontextprotocol.iomy-mcp-server.example.commy.test.proxy.example.commy.test.server.example.complatform.claude.comproxy.examplepypi.orgslack.comwww.apache.org
Findings (3)
Pattern matches are leads, not proof. A finding in documentation is often harmless; one in a script deserves a closer look.
MediumReads secret environment variablesSecrets & credentials

Reads variables named like API keys, tokens or passwords, or dumps the whole environment. Check where the values go.

skills/claude-api/shared/preserved-thinking-migration/drop_block_probe.py:403

key = os.environ.get("ANTHROPIC_API_KEY")
MediumReads secret environment variablesSecrets & credentials

Reads variables named like API keys, tokens or passwords, or dumps the whole environment. Check where the values go.

skills/claude-api/shared/preserved-thinking-migration/drop_block_probe.py:404

token = os.environ.get("ANTHROPIC_AUTH_TOKEN")
MediumReads secret environment variablesSecrets & credentials

Reads variables named like API keys, tokens or passwords, or dumps the whole environment. Check where the values go.

skills/claude-api/shared/preserved-thinking-migration/prefix_diff.py:1392

r"(os\.environ|process\.env|getenv\(|uuid|Math\.random\(|random\.choice|request_id|session_id|user_id|cwd\(\)|getcwd\(\)|hostname)",
Files scanned (40)
  • skills/claude-api/csharp/claude-api/batches.md (413 B)
  • skills/claude-api/csharp/claude-api/files-api.md (900 B)
  • skills/claude-api/csharp/claude-api/README.md (18.5 KB)
  • skills/claude-api/csharp/claude-api/streaming.md (787 B)
  • skills/claude-api/csharp/claude-api/tool-use.md (5.9 KB)
  • skills/claude-api/curl/examples.md (9.5 KB)
  • skills/claude-api/curl/managed-agents.md (8.4 KB)
  • skills/claude-api/go/claude-api/files-api.md (936 B)
  • skills/claude-api/go/claude-api/README.md (8.3 KB)
  • skills/claude-api/go/claude-api/streaming.md (1.0 KB)
  • skills/claude-api/go/claude-api/tool-use.md (8.2 KB)
  • skills/claude-api/go/managed-agents/README.md (18.5 KB)
  • skills/claude-api/java/claude-api/files-api.md (1.2 KB)
  • skills/claude-api/java/claude-api/README.md (11.7 KB)
  • skills/claude-api/java/claude-api/streaming.md (655 B)
  • skills/claude-api/java/claude-api/tool-use.md (9.3 KB)
  • skills/claude-api/java/managed-agents/README.md (16.5 KB)
  • skills/claude-api/LICENSE.txt (11.1 KB)
  • skills/claude-api/php/claude-api/batches.md (447 B)
  • skills/claude-api/php/claude-api/files-api.md (476 B)
  • skills/claude-api/php/claude-api/README.md (6.4 KB)
  • skills/claude-api/php/claude-api/streaming.md (682 B)
  • skills/claude-api/php/claude-api/tool-use.md (7.9 KB)
  • skills/claude-api/php/managed-agents/README.md (13.2 KB)
  • skills/claude-api/python/claude-api/batches.md (5.5 KB)
  • skills/claude-api/python/claude-api/files-api.md (4.4 KB)
  • skills/claude-api/python/claude-api/README.md (20.0 KB)
  • skills/claude-api/python/claude-api/sdk-upgrade.md (28.1 KB)
  • skills/claude-api/python/claude-api/streaming.md (11.7 KB)
  • skills/claude-api/python/claude-api/tool-use.md (19.3 KB)
  • skills/claude-api/python/managed-agents/README.md (11.2 KB)
  • skills/claude-api/ruby/claude-api/README.md (4.7 KB)
  • skills/claude-api/ruby/claude-api/streaming.md (235 B)
  • skills/claude-api/ruby/claude-api/tool-use.md (1.0 KB)
  • skills/claude-api/ruby/managed-agents/README.md (10.2 KB)
  • skills/claude-api/shared/evals/report/build-report-lite.mjs (26.7 KB)
  • skills/claude-api/shared/evals/report/runner-scaffold.mjs (32.4 KB)
  • skills/claude-api/shared/preserved-thinking-migration/drop_block_probe.py (62.8 KB)
  • skills/claude-api/shared/preserved-thinking-migration/prefix_diff.py (91.8 KB)
  • skills/claude-api/SKILL.md (99.3 KB)
Add the badge to your README
Shows the current grade and links back to this report. It updates when the skill is rescanned.
SkillsVetted grade B
[![SkillsVetted grade](https://skillsvetted.com/badge/anthropics/claude-api.svg)](https://skillsvetted.com/skills/anthropics/claude-api)
Rescan
Pull the latest commit from GitHub and update this listing.
Want a human to check it?

A full review covers what pattern matching can't: intent, logic and behavior in a sandbox.

Request full review