AB claude-api
Build apps with the Claude API or Anthropic SDK. TRIGGER when: code imports `anthropic`/`@anthropic-ai/sdk`/`claude_agent_sdk`, or user asks to use Claude API, Anthropic SDKs, or Agent SDK. DO NOT TRIGGER when: code imports `openai`/other AI SDK, general programming, or ML/data-science tasks.
Build apps with the Claude API or Anthropic SDK.
As a process B 77/100 · Nearly there — weak spots: running it twice, progress reporting
How to improve
- Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
- A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.
Guard findings · 5
✓ No critical or high findings
Medium and low: 5
-
low Secrets in code
secret-high-entropy-tokenpython/claude-api/files-api.md:97High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)file_info = client.beta.files.retrieve_metadata("file…V8w")quoted -
low Secrets in code
secret-high-entropy-tokenpython/claude-api/files-api.md:105High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)client.beta.files.delete("file…V8w")quoted -
low Secrets in code
secret-high-entropy-tokenpython/claude-api/files-api.md:113High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)file_content = client.beta.files.download("file…V8w")quoted -
low Secrets in code
secret-high-entropy-tokentypescript/claude-api/files-api.md:84High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)await client.beta.files.delete("file…V8w", {quoted -
low Secrets in code
secret-high-entropy-tokentypescript/claude-api/files-api.md:93High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)"file…V8w",
quoted
Files scanned: 26. Evidence is masked. Grey chips explain why severity was lowered.
Against the Agent Skills spec
- note
frontmatter-keyunknown frontmatter key "risk" - note
frontmatter-keyunknown frontmatter key "source" - note
frontmatter-keyunknown frontmatter key "date_added" - note
edit-residuethe text marks something as outdated (lines 127, 151, 155, 236, 240): check that old rules are not kept next to new ones — the full check reads the text for contradictions
Process rating: all ten parameters 77/100
- 0Progress reporting. Says nothing while it works
- 30Running it twice. 6 mutating operations with no state check
- 60Tools and files. Uses tools (bash, web, python) that frontmatter does not declare
- 60Steps. 54 steps, 5 vague phrases
- 70Inputs and preconditions. Inputs and preconditions are listed
- 70Execution cost. Instruction body is 4576 tokens
- 100Result and completion. Output format and completion criterion are stated
- 100When it triggers. States when to use and when not to
- 100Failures and branches. 4 branches, has a failure section
- 100Consistency. Name and required fields are in place
- medium Safety rules and hard prohibitions inside a skill: they belong in the system prompt, here they protect nothing
- low 12 top-level sections: this looks like several domains in one skill
Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.
Quality signals
- +5Description has no quoted example phrases that should trigger the skill
- +2Single-language instructions
- +4Description says when NOT to use the skill
- +3Description length 293: enough signal without eating the budget
- +4Structure: 19 headings
- +3Step-by-step instructions: 54 items
- +3Output format is stated explicitly
- +4Has examples (1 code blocks)
- +1License stated
Quality base 70; lint remarks subtract, signals add up to 100. Result: 89.