Is @anthropic-ai/sdk safe?
- Node.js shell/command execution
- Node.js filesystem read
- Node.js filesystem write/delete
@anthropic-ai/sdk is an AI npm_package analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators, though 5 risky constructs are reported for review. It can: filesystem read, filesystem write, network egress, scoped identity and shell execution — capabilities are what the code can do, not a verdict on intent. Risk score 0/100 (low).
@anthropic-ai/sdk 0.120.0
Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of @anthropic-ai/sdk's authors. Report a false positive.
Behavioral traits
How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.
Findings (5)
The component can run operating-system commands or spawn processes.
const match = pattern.exec(navigator.userAgent);
const match = pattern.exec(navigator.userAgent);
while ((match = invalidSegmentPattern.exec(pathOnly)) !== null) {while ((match = invalidSegmentPattern.exec(pathOnly)) !== null) {const match = pattern.exec(navigator.userAgent);
while ((match = invalidSegmentPattern.exec(pathOnly)) !== null) {import * as cp from 'node:child_process';
* across exec() calls. Uses pipes rather than a PTY so input is never echoed.
this.#proc = cp.spawn('/bin/bash', ['--noprofile', '--norc'], {async exec(
const { output, exitCode } = await session.exec(command, {const proc = cp.spawn(rg, ['-n', '--no-heading', '-e', pattern, '--', searchPath], {import { execFile } from 'node:child_process';exec(_command: string, _opts?: {exec(_command, _opts = {}) {exec(_command, _opts = {}) {* across exec() calls. Uses pipes rather than a PTY so input is never echoed.
exec(command: string, opts?: {const cp = tslib_1.__importStar(require("node:child_process"));* across exec() calls. Uses pipes rather than a PTY so input is never echoed.
tslib_1.__classPrivateFieldSet(this, _BashSession_proc, cp.spawn('/bin/bash', ['--noprofile', '--norc'], {async exec(command, opts = {}) {const { output, exitCode } = await session.exec(command, {const proc = cp.spawn(rg, ['-n', '--no-heading', '-e', pattern, '--', searchPath], {Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.
Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.
The component reads files from disk.
* the result of fs.createReadStream().
* file: fs.createReadStream('path/to/file'),* file: fs.createReadStream('path/to/file'),* file: fs.createReadStream('path/to/file'),* files: [fs.createReadStream('path/to/file')],* files: [fs.createReadStream('path/to/file')],* files: [fs.createReadStream('path/to/file')],* { files: [fs.createReadStream('path/to/file')] },* { files: [fs.createReadStream('path/to/file')] },* { files: [fs.createReadStream('path/to/file')] },* the result of fs.createReadStream().
* file: fs.createReadStream('path/to/file'),* files: [fs.createReadStream('path/to/file')],* { files: [fs.createReadStream('path/to/file')] },data = await fs.readFile(abs, 'utf8');
data = await fs.readFile(abs, 'utf8');
return await fs.readFile(fullPath, 'utf-8');
data = await fs.readFile(abs, 'utf8');
data = await fs.readFile(abs, 'utf8');
data = await fs.readFile(abs, 'utf8');
data = await fs.readFile(abs, 'utf8');
return await fs.readFile(fullPath, 'utf-8');
return await fs.readFile(fullPath, 'utf-8');
Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.
Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.
The component writes or deletes files on disk.
await fs.unlink(tempPath).catch(() => {});await fs.rm(dest, { recursive: true, force: true });await fs.rm(dest, { recursive: true, force: true }).catch((e) => {await fs.rm(tmp, { force: true });await fs.rm(excludeFile, { force: true });await fs.rm(stage, { recursive: true, force: true });await fs.writeFile(excludeFile, patterns.join('\n') + '\n', { flag: 'wx', mode: 0o600 });await fs.unlink(tempPath).catch(() => {});await fs.rm(fullPath, { recursive: true, force: false });await fs.unlink(tempPath).catch(() => { });await fs.unlink(tempPath).catch(() => { });await fs.rm(dest, { recursive: true, force: true });await fs.rm(dest, { recursive: true, force: true }).catch((e) => {await fs.rm(tmp, { force: true });await fs.rm(excludeFile, { force: true });await fs.rm(stage, { recursive: true, force: true });await fs.writeFile(excludeFile, patterns.join('\n') + '\n', { flag: 'wx', mode: 0o600 });await fs.rm(dest, { recursive: true, force: true });await fs.rm(dest, { recursive: true, force: true }).catch((e) => {await fs.rm(tmp, { force: true });await fs.rm(excludeFile, { force: true });await fs.rm(stage, { recursive: true, force: true });await fs.writeFile(excludeFile, patterns.join('\n') + '\n', { flag: 'wx', mode: 0o600 });await fs.unlink(tempPath).catch(() => { });await fs.rm(fullPath, { recursive: true, force: false });Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.
Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.
The component makes outbound network requests.
* timeout/abort errors, errors thrown by `fetch()`, and `APIConnectionError`s
// Expo fetch
('message' in err && String(err.message).includes('FetchRequestCanceledException'))));// Expo fetch
('message' in err && String(err.message).includes('FetchRequestCanceledException'))));: (await fetch('data:,')).constructor);: (await fetch('data:,')).constructor);resp = await config.fetch(url, {resp = await config.fetch(url, {resp = await config.fetch(url, {resp = await config.fetch(url, {* timeout/abort errors, errors thrown by `fetch()`, and `APIConnectionError`s
// Expo fetch
('message' in err && String((err as any).message).includes('FetchRequestCanceledException'))): (await fetch('data:,')).constructor) as typeof Response;resp = await config.fetch(url, {resp = await config.fetch(url, {Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.
Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.
A short-lived, scoped, assumed identity was detected — an STS AssumeRole / session token, a cloud managed or workload identity, an impersonated service account, a projected Kubernetes service-account token, or a dynamic-secret broker. Tools authenticate with a narrowly-scoped credential that expires, rather than a long-lived embedded service credential. (2 occurrence(s) shown as evidence).
* An {@link AccessTokenProvider} for OAuth/workload-identity authentication.* An {@link AccessTokenProvider} for OAuth/workload-identity authentication.Fix: A scoped, short-lived identity is the smallest-blast-radius execution context. Confirm the assumed role / requested scope grants only the permissions the tool needs, and that the token lifetime is minimal.
Check your own component
Run the same evidence-backed scan on any MCP server, agent skill, or package.
Scan your own componentHow we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →