claude-api

What it claims to do

|- Reference for the Claude API / Anthropic SDK — model ids, pricing, params, streaming, tool use, MCP, agents, caching, token counting, model migration. TRIGGER — read BEFORE opening the target file; don't skip because it "looks like a one…

What we found · 8

• Description doesn’t say WHEN to use itmediumA good description names the trigger (e.g. "when reviewing a PR"). Without it the skill mis-fires or never fires.
• Trigger is too broadmediumWords like "whenever", "any", "all" make it fire everywhere and fight other skills for the same task — the #1 cause of conflicts.
• Bloated: high token costmedium~18,325 tokens on every single call. Compress instructions and trim examples.
• References API keys / env configmediumReads an API key or env var — normal for API clients. Ensure keys come from the runtime (not hardcoded); a leak risk only if sent to an untrusted endpoint.
• Contains curl / wget network commandmediumAccesses the network from the shell. If the target is untrusted it can pull malware or exfiltrate data.
• Reads credentials and makes network calls — verify the destinationmediumThe normal shape of an API client (your key → the API). Static analysis sees the capability, not the intent — confirm the endpoint is one you trust; it is a data-leak risk only if it is not.
• Description too longlowThe description is read on every trigger check; overly long ones waste tokens and dilute the signal.
• Repeated contentlow~2 duplicate lines detected; de-duping is free token savings.

Conflicts with · 8

If you have both installed, they compete for the same triggers — the top cause of an agent picking the wrong skill.