Skills claude-api
📦
claude-api
Content revision r3 High Risk 📁 Filesystem access🔑 Env variables⚙️ External commands🌐 Network access⚡ Contains scripts
Build Reliable Claude API Integrations
Claude API details change across models, SDKs, and platforms. This skill provides current, language-specific guidance for implementation, migration, authentication, and debugging.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "claude-api" from https://skillstore.io/skills/claude-api.md and its manifest at https://skillstore.io/api/skills/claude-api/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "claude-api". Create a Python request that summarizes support tickets with Claude.
Expected outcome:
A concise implementation plan covering client initialization, model selection, message construction, error handling, and token usage.
Using "claude-api". Explain why my streaming tool loop stops after the first tool call.
Expected outcome:
- The likely control-flow cause and the relevant stop reason.
- A corrected loop sequence with validation and iteration limits.
- Checks for malformed tool results and partial stream events.
Using "claude-api". Plan a managed agent that reviews repositories every weekday.
Expected outcome:
An architecture covering the agent, environment, repository resource, credentials, session lifecycle, schedule, observability, and failure recovery.
Security Audit
High Riskv8 • 7/23/2026 Open versioned report
The skill is documentation-focused, but it intentionally demonstrates network, environment, filesystem, and external-command operations. Most severe detector matches are syntax or prose false positives; privileged archive extraction and shell evaluation of credential output remain high-risk guidance. Static review was capped at 400/668 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
66
Files scanned
15,086
Lines analyzed
192
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Unverified Archive Extracted with Elevated Privileges
The Linux installation example downloads a version-selected archive and pipes it directly to sudo tar without checksum or signature verification.
The two-line command clearly combines a remote download, a pipe, and privileged extraction into a system binary directory.
High
Credential Output Evaluated as Shell Code
The authentication example passes generated credential assignments through eval. A malformed or attacker-controlled value could become shell code.
The example explicitly uses eval on command output containing credentials and an optional configured base URL.
Capability review items (192)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
AWS credential environment variables
The client resolves AWS credentials via the standard precedence chain: explicit constructor args → e
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
// Default (uses ANTHROPIC_API_KEY env var)
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
ApiKey = Environment.GetEnvironmentVariable("ANTHROPIC_API_KEY")
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
export ANTHROPIC_API_KEY="your-api-key"
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
-H "x-api-key: $ANTHROPIC_API_KEY" \
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
-H "x-api-key: $ANTHROPIC_API_KEY" \
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
-H "x-api-key: $ANTHROPIC_API_KEY" \
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
-H "x-api-key: $ANTHROPIC_API_KEY" \
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
-H "x-api-key: $ANTHROPIC_API_KEY" \
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
-H "x-api-key: $ANTHROPIC_API_KEY" \
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
-H "x-api-key: $ANTHROPIC_API_KEY" \
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
-H "x-api-key: $ANTHROPIC_API_KEY" \
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
export ANTHROPIC_API_KEY="your-api-key"
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
-H "x-api-key: $ANTHROPIC_API_KEY"
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
-H "x-api-key: $ANTHROPIC_API_KEY" \
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
-H "x-api-key: $ANTHROPIC_API_KEY" \
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
-H "x-api-key: $ANTHROPIC_API_KEY" \
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
// Default (uses ANTHROPIC_API_KEY env var)
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
// Default (uses ANTHROPIC_API_KEY env var)
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
// Default (reads ANTHROPIC_API_KEY from environment)
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
// Default (uses ANTHROPIC_API_KEY env var)
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
$client = new Client(apiKey: getenv("ANTHROPIC_API_KEY"));
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
apiKey: getenv('ANTHROPIC_FOUNDRY_API_KEY'),
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
// Default (uses ANTHROPIC_API_KEY env var)
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
'x-api-key: ' . getenv('ANTHROPIC_API_KEY'),
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
# ANTHROPIC_API_KEY, or ANTHROPIC_AUTH_TOKEN, or an `ant auth login` profile.
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
client = anthropic.Anthropic(api_key="your-api-key")
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
# ANTHROPIC_API_KEY, or ANTHROPIC_AUTH_TOKEN, or an `ant auth login` profile.
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
client = anthropic.Anthropic(api_key="your-api-key")
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
# Default (uses ANTHROPIC_API_KEY env var)
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
client = Anthropic::Client.new(api_key: "your-api-key")
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
# Default (uses ANTHROPIC_API_KEY env var)
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
client = Anthropic::Client.new(api_key: "your-api-key")
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
**Auth** — the CLI resolves credentials the same way the SDKs do (first match wins): explicit flags,
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
- **API key**: set `ANTHROPIC_API_KEY` in the environment.
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
- **OAuth profile** (no static key to manage): `ant auth login` opens a browser, exchanges for a sho
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
> **The #1 auth trap:** profiles are only consulted when no API key is set. A stale exported `ANTHRO
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
OAuth tokens go on `Authorization: Bearer` (not `x-api-key:`) **plus the `anthropic-beta: oauth-2025
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
**Foot-gun:** `ant auth print-credentials` with **no flags** prints the entire credentials JSON, not
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
- Both `ANTHROPIC_API_KEY` and `ANTHROPIC_AUTH_TOKEN` set — the SDK sends both headers and the API r
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
**Fix:** Set `ANTHROPIC_API_KEY`, or run `ant auth login` and leave the client constructor empty. Fo
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
-H "x-api-key: $ANTHROPIC_API_KEY" \
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
-H "x-api-key: $ANTHROPIC_API_KEY" \
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
**An unset `ANTHROPIC_API_KEY` does NOT mean there are no credentials.** The SDKs and the `ant` CLI
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
**When you need to call the API and `ANTHROPIC_API_KEY` is unset, don't ask the user for a key.** Fi
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
Only ask the user for a key if `ant auth status` reports no active credential source (or `ant` itsel
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
**GA, no beta header.** Construct the normal zero-arg client (`Anthropic()` / `new Anthropic()` / `a
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
- **No `ANTHROPIC_API_KEY` ≠ no credentials.** Don't bail or ask the user for a key just because the
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
- **WIF auth: unset `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, and `ANTHROPIC_PROFILE`.** `ANTHROP
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
// ANTHROPIC_API_KEY, or ANTHROPIC_AUTH_TOKEN, or an `ant auth login` profile.
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Generic API/secret keys
// ANTHROPIC_API_KEY, or ANTHROPIC_AUTH_TOKEN, or an `ant auth login` profile.
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Git platform tokens
"authorization_token": os.environ["GITHUB_TOKEN"],
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Git platform tokens
authorization_token: process.env.GITHUB_TOKEN, // repo clone token (≠ MCP auth)
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Git platform tokens
"authorization_token": os.environ["GITHUB_TOKEN"], # repo clone token (≠ MCP auth)
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Git platform tokens
authorization_token: process.env.GITHUB_TOKEN,
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
High
Hidden file in home directory
If a type or member you need isn't in the tables above, `strings ~/.nuget/packages/anthropic/*/lib/*
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
High
Python subprocess.check_output
before = subprocess.check_output(["git", "show", "HEAD:CLAUDE.md"], text=True)
The cited example executes an external command or evaluates shell command substitution. This behavior is intentional but carries command-execution risk.
High
sudo privilege escalation
| sudo tar -xz -C /usr/local/bin ant
The cited example executes an external command or evaluates shell command substitution. This behavior is intentional but carries command-execution risk.
Medium
File stream creation
file: fs.createReadStream("data.csv"),
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
Medium
File stream creation
file: await toFile(fs.createReadStream("report.pdf"), undefined, {
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
Medium
File stream creation
import { createReadStream } from "fs";
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
Medium
File stream creation
file: await toFile(createReadStream("sales_data.csv"), undefined, {
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
Medium
File stream creation
file: fs.createReadStream("data.csv"),
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
Medium
Hidden file access
If a type or member you need isn't in the tables above, `strings ~/.nuget/packages/anthropic/*/lib/*
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
Medium
Node.js fs operations
> **Reading local files (ESM):** `__dirname` and `__filename` are **undefined** in ES modules — usin
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
Medium
Node.js fs operations
const imageData = fs.readFileSync("image.png").toString("base64");
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
Medium
Node.js fs operations
fs.writeFileSync(f.filename, buffer);
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
Medium
Node.js fs promises API
await fs.promises.writeFile("output.txt", content);
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
Medium
Node.js fs promises API
await fs.promises.mkdir(OUTPUT_DIR, { recursive: true });
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
Medium
Node.js fs promises API
await fs.promises.writeFile(outputPath, fileBytes);
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
Medium
Python os file operations
os.makedirs(OUTPUT_DIR, exist_ok=True)
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
Medium
Shell command substitution
response=$(curl -s https://api.anthropic.com/v1/messages \
The cited example executes an external command or evaluates shell command substitution. This behavior is intentional but carries command-execution risk.
Medium
Shell command substitution
input_tokens=$(echo "$response" | jq -r '.usage.input_tokens')
The cited example executes an external command or evaluates shell command substitution. This behavior is intentional but carries command-execution risk.
Medium
Shell command substitution
output_tokens=$(echo "$response" | jq -r '.usage.output_tokens')
The cited example executes an external command or evaluates shell command substitution. This behavior is intentional but carries command-execution risk.
Medium
Shell command substitution
stop_reason=$(echo "$response" | jq -r '.stop_reason')
The cited example executes an external command or evaluates shell command substitution. This behavior is intentional but carries command-execution risk.
Medium
Shell command substitution
response=$(curl -s https://api.anthropic.com/v1/messages \
The cited example executes an external command or evaluates shell command substitution. This behavior is intentional but carries command-execution risk.
Medium
Shell command substitution
if [ "$(echo "$response" | jq -r '.stop_reason')" != "refusal" ] && \
The cited example executes an external command or evaluates shell command substitution. This behavior is intentional but carries command-execution risk.
Medium
Shell command substitution
xattr -d com.apple.quarantine "$(brew --prefix)/bin/ant"
The cited example executes an external command or evaluates shell command substitution. This behavior is intentional but carries command-execution risk.
Medium
Shell command substitution
curl -fsSL "https://github.com/anthropics/anthropic-cli/releases/download/v${VERSION}/ant_${VERSION}
The cited example executes an external command or evaluates shell command substitution. This behavior is intentional but carries command-execution risk.
Medium
Shell command substitution
-H "Authorization: Bearer $(ant auth print-credentials --access-token)" \
The cited example executes an external command or evaluates shell command substitution. This behavior is intentional but carries command-execution risk.
Medium
Shell command substitution
set -a; eval "$(ant auth print-credentials --env)"; set +a
The cited example executes an external command or evaluates shell command substitution. This behavior is intentional but carries command-execution risk.
Medium
Shell command substitution
AGENT_ID=$(ant beta:agents create --name "My Agent" --model '{id: claude-sonnet-5}' \
The cited example executes an external command or evaluates shell command substitution. This behavior is intentional but carries command-execution risk.
Medium
Shell command substitution
AGENT_ID=$(ant beta:agents create < summarizer.agent.yaml --transform id -r)
The cited example executes an external command or evaluates shell command substitution. This behavior is intentional but carries command-execution risk.
Medium
Shell command substitution
FIRST=$(ant beta:agents list --transform id -r --max-items 1)
The cited example executes an external command or evaluates shell command substitution. This behavior is intentional but carries command-execution risk.
Medium
Synchronous file operations
> **Reading local files (ESM):** `__dirname` and `__filename` are **undefined** in ES modules — usin
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
Medium
Synchronous file operations
const imageData = fs.readFileSync("image.png").toString("base64");
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
Medium
Synchronous file operations
import { readFileSync } from "fs";
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
Medium
Synchronous file operations
const pdfBytes = readFileSync(join(__dirname, "sample.pdf"));
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
Medium
Synchronous file operations
Or use a CWD-relative path if the script runs from a known directory: `readFileSync("./sample.pdf")`
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
Medium
Synchronous file operations
fs.writeFileSync(f.filename, buffer);
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
Low
Environment variable access (dot notation)
authorization_token: process.env.GITHUB_TOKEN, // repo clone token (≠ MCP auth)
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
Low
Environment variable access (dot notation)
const environmentKey = process.env.ANTHROPIC_ENVIRONMENT_KEY!;
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
Low
Environment variable access (dot notation)
const environmentId = process.env.ANTHROPIC_ENVIRONMENT_ID!;
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
Low
Environment variable access (dot notation)
authorization_token: process.env.GITHUB_TOKEN,
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
Low
Environment variable object
authorization_token: process.env.GITHUB_TOKEN, // repo clone token (≠ MCP auth)
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
Low
Environment variable object
const environmentKey = process.env.ANTHROPIC_ENVIRONMENT_KEY!;
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
Low
Environment variable object
const environmentId = process.env.ANTHROPIC_ENVIRONMENT_ID!;
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
Low
Environment variable object
authorization_token: process.env.GITHUB_TOKEN,
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
Low
getenv function call
$client = new Client(apiKey: getenv("ANTHROPIC_API_KEY"));
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
Low
getenv function call
apiKey: getenv('ANTHROPIC_FOUNDRY_API_KEY'),
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
Low
getenv function call
'x-api-key: ' . getenv('ANTHROPIC_API_KEY'),
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
Low
Hardcoded URL
curl https://api.anthropic.com/v1/messages \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
response=$(curl -s https://api.anthropic.com/v1/messages \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl https://api.anthropic.com/v1/messages \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl https://api.anthropic.com/v1/messages \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl https://api.anthropic.com/v1/messages \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl https://api.anthropic.com/v1/messages \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl https://api.anthropic.com/v1/messages \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
response=$(curl -s https://api.anthropic.com/v1/messages \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl -X POST https://api.anthropic.com/v1/environments \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl -X POST https://api.anthropic.com/v1/environments \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl -X POST https://api.anthropic.com/v1/agents \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl -X POST https://api.anthropic.com/v1/sessions \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
# Trace: https://platform.claude.com/workspaces/default/sessions/sesn_abc123
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl -X POST https://api.anthropic.com/v1/agents \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl -X POST https://api.anthropic.com/v1/sessions \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
"url": "https://github.com/owner/repo",
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl -X POST https://api.anthropic.com/v1/sessions/$SESSION_ID/events \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl -N https://api.anthropic.com/v1/sessions/$SESSION_ID/events/stream \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl https://api.anthropic.com/v1/sessions/$SESSION_ID/events \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl "https://api.anthropic.com/v1/sessions/$SESSION_ID/events?page=page_abc123" \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl -X POST https://api.anthropic.com/v1/sessions/$SESSION_ID/events \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl -X POST https://api.anthropic.com/v1/sessions/$SESSION_ID/events \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl https://api.anthropic.com/v1/sessions/$SESSION_ID \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl https://api.anthropic.com/v1/sessions \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl -X DELETE https://api.anthropic.com/v1/sessions/$SESSION_ID \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl -X POST https://api.anthropic.com/v1/files \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
fmt.Printf("Trace: https://platform.claude.com/workspaces/default/sessions/%s\n", session.ID)
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
URL: "https://api.githubcopilot.com/mcp/",
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
MCPServerURL: "https://mcp.slack.com/mcp",
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
TokenEndpoint: "https://slack.com/api/oauth.v2.access",
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
URL: "https://github.com/org/repo",
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
URL: "https://github.com/org/frontend",
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
URL: "https://github.com/org/backend",
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
.url("https://example.com/mcp")
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
System.out.println("Trace: https://platform.claude.com/workspaces/default/sessions/" + session.id())
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
.url("https://api.githubcopilot.com/mcp/")
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
.mcpServerUrl("https://mcp.slack.com/mcp")
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
.tokenEndpoint("https://slack.com/api/oauth.v2.access")
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
.url("https://github.com/org/repo")
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
.url("https://github.com/org/frontend")
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
.url("https://github.com/org/backend")
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
baseUrl: 'https://<resource>.services.ai.azure.com/anthropic/v1',
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
url: 'https://example.com/mcp',
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
echo "Trace: https://platform.claude.com/workspaces/default/sessions/{$session->id}\n";
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
$ch = curl_init('https://api.anthropic.com/v1/files');
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
url: 'https://api.githubcopilot.com/mcp/',
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
'mcp_server_url' => 'https://mcp.slack.com/mcp',
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
'token_endpoint' => 'https://slack.com/api/oauth.v2.access',
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
'url' => 'https://github.com/org/repo',
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
'url' => 'https://github.com/org/frontend',
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
'url' => 'https://github.com/org/backend',
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
base_url="http://my.test.server.example.com:8083", # or ANTHROPIC_BASE_URL env var
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
http_client=DefaultHttpxClient(proxy="http://my.test.proxy.example.com"),
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
"url": "https://example.com/image.png"
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
print(f"Trace: https://platform.claude.com/workspaces/default/sessions/{session.id}")
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
"url": "https://github.com/owner/repo",
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
{"type": "url", "name": "my-tools", "url": "https://my-mcp-server.example.com/sse"},
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
puts "Trace: https://platform.claude.com/workspaces/default/sessions/#{session.id}"
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
url: "https://api.githubcopilot.com/mcp/"
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
mcp_server_url: "https://mcp.slack.com/mcp",
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
token_endpoint: "https://slack.com/api/oauth.v2.access",
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
url: "https://github.com/org/repo",
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
url: "https://github.com/org/frontend",
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
url: "https://github.com/org/backend",
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl -fsSL "https://github.com/anthropics/anthropic-cli/releases/download/v${VERSION}/ant_${VERSION}
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl https://api.anthropic.com/v1/messages \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
"url": "https://api.githubcopilot.com/mcp/"
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
"url": "https://github.com/owner/repo (required)",
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
"mcp_servers": [{"type": "url", "name": "linear", "url": "https://mcp.linear.app/sse"}],
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
{ type: 'url', name: 'github', url: 'https://api.githubcopilot.com/mcp/' },
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
url: 'https://github.com/owner/repo',
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
"url": "https://api.githubcopilot.com/mcp/",
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
"url": "https://github.com/owner/repo",
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl -fsSL https://api.anthropic.com/v1/deployments \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
{ "type": "url", "name": "linear", "url": "https://mcp.linear.app/mcp" }
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
"mcp_server_url": "https://mcp.notion.com/mcp",
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
"token_endpoint": "https://api.notion.com/v1/oauth/token",
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
curl https://api.anthropic.com/v1/models/claude-opus-4-8 \
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
mcp_servers=[{"type": "url", "url": "https://example/sse", "name": "example-mcp"}],
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
source: { type: "url", url: "https://example.com/image.png" },
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
console.log(`Trace: https://platform.claude.com/workspaces/default/sessions/${session.id}`);
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
url: "https://github.com/owner/repo",
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Hardcoded URL
{ type: "url", name: "my-tools", url: "https://my-mcp-server.example.com/sse" },
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
HTTP client library
const result = await linear.request(event.input.query, event.input.vars) // host's key
The cited example contains a concrete service URL or client request used for API, repository, OAuth, or MCP network access.
Low
Python environment access
"authorization_token": os.environ["GITHUB_TOKEN"],
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
Low
Python environment access
"authorization_token": os.environ["GITHUB_TOKEN"], # repo clone token (≠ MCP auth)
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
Low
Python environment access
environment_key = os.environ["ANTHROPIC_ENVIRONMENT_KEY"]
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
Low
Python environment access
environment_id = os.environ["ANTHROPIC_ENVIRONMENT_ID"]
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
Low
Python environment access
environment_key = os.environ["ANTHROPIC_ENVIRONMENT_KEY"]
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
Low
Python environment access
environment_id = os.environ["ANTHROPIC_ENVIRONMENT_ID"]
The cited guidance reads, sets, or relies on an environment variable for authentication or configuration. The access is intentional and documented.
Low
Standard device file access
ant beta:sessions:events send --session-id "$SID" > /dev/null <<'YAML'
The cited example performs or recommends a local filesystem operation. It is documented functionality, but filesystem access is real.
Risk Factors
📁 Filesystem access (48)
csharp/claude-api/README.md:42 csharp/claude-api/README.md:42 csharp/claude-api/tool-use.md:3 csharp/claude-api/tool-use.md:38 curl/examples.md:239 go/claude-api/tool-use.md:3 go/managed-agents/README.md:155 java/claude-api/tool-use.md:3 java/claude-api/tool-use.md:77 java/claude-api/tool-use.md:106 java/managed-agents/README.md:120 php/claude-api/tool-use.md:3 php/claude-api/tool-use.md:49 php/managed-agents/README.md:108 python/claude-api/tool-use.md:3 python/claude-api/tool-use.md:342 python/managed-agents/README.md:125 python/managed-agents/README.md:195 ruby/claude-api/tool-use.md:3 ruby/claude-api/tool-use.md:38 ruby/managed-agents/README.md:105 shared/anthropic-cli.md:34 shared/anthropic-cli.md:34 shared/anthropic-cli.md:199 shared/managed-agents-environments.md:73 shared/tool-use-concepts.md:140 SKILL.md:228 SKILL.md:228 typescript/claude-api/files-api.md:26 typescript/claude-api/files-api.md:97 typescript/claude-api/README.md:13 typescript/claude-api/README.md:112 typescript/claude-api/README.md:13 typescript/claude-api/README.md:112 typescript/claude-api/README.md:13 typescript/claude-api/README.md:247 typescript/claude-api/tool-use.md:278 typescript/claude-api/tool-use.md:283 typescript/claude-api/tool-use.md:286 typescript/claude-api/tool-use.md:292 typescript/claude-api/tool-use.md:298 typescript/claude-api/tool-use.md:335 typescript/claude-api/tool-use.md:354 typescript/claude-api/tool-use.md:3 typescript/managed-agents/README.md:307 typescript/managed-agents/README.md:307 typescript/managed-agents/README.md:274 typescript/managed-agents/README.md:135
🔑 Env variables (50)
csharp/claude-api/README.md:108 csharp/claude-api/README.md:113 curl/examples.md:8 curl/examples.md:18 curl/examples.md:39 curl/examples.md:65 curl/examples.md:104 curl/examples.md:129 curl/examples.md:167 curl/examples.md:192 curl/examples.md:217 curl/managed-agents.md:8 curl/managed-agents.md:13 curl/managed-agents.md:252 curl/managed-agents.md:267 curl/managed-agents.md:273 go/claude-api/README.md:19 go/managed-agents/README.md:23 java/claude-api/README.md:66 java/managed-agents/README.md:21 php/claude-api/README.md:17 php/claude-api/README.md:50 php/claude-api/README.md:17 php/claude-api/README.md:50 php/managed-agents/README.md:219 php/managed-agents/README.md:18 php/managed-agents/README.md:219 python/claude-api/README.md:15 python/claude-api/README.md:20 python/managed-agents/README.md:102 python/managed-agents/README.md:102 python/managed-agents/README.md:19 python/managed-agents/README.md:24 ruby/claude-api/README.md:16 ruby/claude-api/README.md:20 ruby/managed-agents/README.md:18 ruby/managed-agents/README.md:22 shared/anthropic-cli.md:31 shared/anthropic-cli.md:33 shared/anthropic-cli.md:34 shared/anthropic-cli.md:37 shared/anthropic-cli.md:71 shared/anthropic-cli.md:73 shared/claude-platform-on-aws.md:49 shared/claude-platform-on-aws.md:51 shared/error-codes.md:59 shared/error-codes.md:61 shared/managed-agents-api-reference.md:197 shared/managed-agents-environments.md:166 shared/managed-agents-environments.md:166
⚙️ External commands (50)
curl/examples.md:37-41 curl/examples.md:47 curl/examples.md:48 curl/examples.md:51 curl/examples.md:215-225 curl/examples.md:238 go/claude-api/tool-use.md:23-72 go/claude-api/tool-use.md:147-148 go/claude-api/tool-use.md:148-170 java/managed-agents/README.md:61 java/managed-agents/README.md:90 php/claude-api/README.md:36 python/claude-api/README.md:15-24 python/managed-agents/README.md:19-25 shared/anthropic-cli.md:66 shared/anthropic-cli.md:21 shared/anthropic-cli.md:24 shared/anthropic-cli.md:59 shared/anthropic-cli.md:67 shared/anthropic-cli.md:115-116 shared/anthropic-cli.md:175 shared/anthropic-cli.md:234 shared/anthropic-cli.md:66-69 shared/anthropic-cli.md:244 shared/anthropic-cli.md:25 shared/managed-agents-client-patterns.md:27-36 shared/managed-agents-onboarding.md:67 shared/managed-agents-onboarding.md:69 shared/managed-agents-onboarding.md:71 shared/managed-agents-onboarding.md:75 shared/managed-agents-onboarding.md:76 shared/managed-agents-onboarding.md:77-80 shared/managed-agents-onboarding.md:80 shared/managed-agents-onboarding.md:82 shared/managed-agents-scheduled-deployments.md:118-122 shared/managed-agents-self-hosted-sandboxes.md:77 shared/token-counting.md:51 SKILL.md:5 SKILL.md:6 SKILL.md:16 SKILL.md:22 SKILL.md:23 SKILL.md:25 SKILL.md:27 SKILL.md:29 SKILL.md:35 SKILL.md:39 SKILL.md:43 SKILL.md:44 SKILL.md:45
🌐 Network access (50)
curl/examples.md:16 curl/examples.md:37 curl/examples.md:63 curl/examples.md:102 curl/examples.md:127 curl/examples.md:165 curl/examples.md:190 curl/examples.md:215 curl/managed-agents.md:24 curl/managed-agents.md:38 curl/managed-agents.md:64 curl/managed-agents.md:74 curl/managed-agents.md:81 curl/managed-agents.md:88 curl/managed-agents.md:112 curl/managed-agents.md:121 curl/managed-agents.md:135 curl/managed-agents.md:152 curl/managed-agents.md:175 curl/managed-agents.md:179 curl/managed-agents.md:190 curl/managed-agents.md:208 curl/managed-agents.md:224 curl/managed-agents.md:233 curl/managed-agents.md:242 curl/managed-agents.md:251 curl/managed-agents.md:266 curl/managed-agents.md:272 curl/managed-agents.md:284 curl/managed-agents.md:294 curl/managed-agents.md:300 curl/managed-agents.md:309 curl/managed-agents.md:325 go/managed-agents/README.md:98 go/managed-agents/README.md:392 go/managed-agents/README.md:451 go/managed-agents/README.md:455 go/managed-agents/README.md:513 go/managed-agents/README.md:532 go/managed-agents/README.md:540 java/claude-api/README.md:193 java/claude-api/tool-use.md:200 java/managed-agents/README.md:78 java/managed-agents/README.md:303 java/managed-agents/README.md:358 java/managed-agents/README.md:362 java/managed-agents/README.md:404 java/managed-agents/README.md:419 java/managed-agents/README.md:425 php/claude-api/README.md:51
⚡ Contains scripts (12)
go/claude-api/README.md:14-17 go/claude-api/tool-use.md:12-19 go/claude-api/tool-use.md:91-98 go/managed-agents/README.md:16-21 php/claude-api/tool-use.md:200 php/managed-agents/README.md:41 php/managed-agents/README.md:54 php/managed-agents/README.md:233 php/managed-agents/README.md:312 php/managed-agents/README.md:319 php/managed-agents/README.md:320 php/managed-agents/README.md:329
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/claude-api/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/claude-api?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/claude-api?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/claude-api/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/claude-api.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
anthropics. (2026). claude-api security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/claude-api/audits/8BibTeX citation
@techreport{anthropics-claude-api-2026,
author = {anthropics},
title = {claude-api security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/claude-api/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "claude-api security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "anthropics"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/claude-api/audits/8"
identifiers:
- type: other
value: "skillstore:claude-api:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
87
Content
73
Community
78
Spec Compliance
What You Can Build
Create a Claude API prototype
Generate a minimal request with the correct SDK, model identifier, authentication, and error handling.
Migrate an existing integration
Update deprecated model identifiers, thinking parameters, tools, and retry behavior for current Claude models.
Design a managed agent workflow
Plan agents, environments, sessions, resources, memory, events, and deployment controls for an operational workflow.
Try These Prompts
Send a first message
Create a minimal Claude API request in [language] that sends [message] and prints the response.
Add streaming
Update my [language] Claude request to stream text, handle errors, and report final token usage.
Implement tool use
Design a Claude tool loop for [task] in [language], including validation, tool results, iteration limits, and failure handling.
Migrate a production integration
Review [project or file] and migrate its Claude integration to [target model], preserving behavior, tests, observability, caching, and retry controls.
Best Practices
- Use the official SDK for the project language and verify current model identifiers.
- Keep credentials in approved secret stores and grant only required scopes.
- Add timeouts, retry limits, validation, logging, and cost monitoring before production use.
Avoid
- Do not invent model identifiers, SDK methods, or beta header versions.
- Do not print credentials or place long-lived secrets in source files.
- Do not run unbounded tool loops or trust tool inputs and outputs without validation.
Frequently Asked Questions
Which languages does this skill cover?
It covers Python, TypeScript, Java, Go, PHP, Ruby, C#, and direct curl requests.
Does it provide current Claude model identifiers?
Yes. It includes a model reference and migration guidance, but live availability should still be verified.
Can it help with tool use and MCP?
Yes. It explains tool schemas, execution loops, server tools, MCP connections, validation, and common failures.
Does it require an Anthropic API key?
It requires a supported credential source, such as an API key, OAuth profile, or configured cloud identity.
Can it migrate an existing Claude integration?
Yes. It maps older models and request patterns to current SDK and API behavior.
Does it execute API calls automatically?
The skill provides guidance and examples. Execution depends on the host agent, available tools, credentials, and user authorization.
Developer Details
Author
anthropicsLicense
Complete terms in LICENSE.txt
Skillstore revision
r3
Version notice
The author did not declare a version.
Ref
c43861a65bb95efcae259cd161c9d6f4dc7eec6f
Maintenance freshness
7/24/2026
Usage
11 downloads · 399 views
File structure
📁 csharp/
📁 curl/
📁 go/
📁 java/
📁 php/
📁 python/
📁 ruby/
📁 shared/
📄 managed-agents-api-reference.md
📄 managed-agents-client-patterns.md
📄 managed-agents-environments.md
📄 managed-agents-multiagent.md
📄 managed-agents-onboarding.md
📄 managed-agents-scheduled-deployments.md
📄 managed-agents-self-hosted-sandboxes.md
📄 SKILL.md