Anthropic Chat

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a straightforward Anthropic API wrapper, but it uses your Anthropic API key and sends task text to Anthropic.

This skill is reasonable to install if you intend to call Anthropic's Messages API with your own key. Before using it, set a limited Anthropic API key, be mindful of API costs, and avoid sending sensitive content you do not want processed by Anthropic.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill can make Anthropic API calls using the user's key.

Why it was flagged

The code uses a user-provided Anthropic API key. This is expected for the stated purpose, but it is account authority that can incur usage charges and should be intentionally provided.

Skill content

const API_KEY = process.env.ANTHROPIC_API_KEY || process.env.ANTHROPOPIC_API_KEY;

Recommendation

Use a dedicated Anthropic API key with appropriate spending limits, and revoke it if you stop using the skill.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Any task text sent through this skill may be transmitted to Anthropic and processed by Claude.

Why it was flagged

The skill sends message content to Anthropic's external Messages API and returns the provider response. This is disclosed and purpose-aligned, but it is still an external model/provider data flow.

Skill content

const url = new URL('https://api.anthropic.com/v1/messages');

Recommendation

Avoid sending secrets or private data unless you are comfortable with Anthropic processing it, and treat returned model content as untrusted assistant output.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users have limited provenance information for the included helper script.

Why it was flagged

The package includes a local JavaScript helper but does not provide source/homepage provenance or an install spec. No remote download or suspicious dependency is shown, so this is a transparency note rather than a concern.

Skill content

Source: unknown; Homepage: none; No install spec — this is an instruction-only skill; Code file presence: anthropic-chat.js

Recommendation

Review the included JavaScript before use and prefer packages with clear source provenance when available.