SkillTotal

Is anthropic safe?

No malicious indicators - review capabilities before installing
Notable — review in context (capabilities are not malware):
  • Python filesystem read
  • Python filesystem write/delete
  • Python network egress

What to do: Nothing here argues against installing it. Grant the capabilities it lists only if you expect the tool to need them.

anthropic is a PyPI package analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators. It can: delegated authentication, filesystem read, filesystem write, mcp tools detected, network egress and scoped identity — capabilities are what the code can do, not a verdict on intent. Risk score 0/100 (low).

anthropic 1.11.0

python_package · pypi:anthropic
LOW
0
/ 100 risk score
Snapshot · scanned Oct 5, 2026 · anthropic@1.11.0 · engine 0.54.0 / ruleset 61

Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of anthropic's authors. Report a false positive.

Capabilities — what this component can do (not a risk score):
delegated authenticationfilesystem readfilesystem writemcp tools detectednetwork egressscoped identity

Behavioral traits

How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.

Tool surface
Tool Usage
Filesystem reach
Tool Execution Context
Network egress
Interaction & Communication / Direct Communication
Delegated authentication
Tool Execution Context / User Delegated Credentials
Scoped / least-privilege identity
Tool Execution Context / Least-Privilege Service Identity

Findings (6)

MEDIUMPython filesystem readST-FS-PY-READ

The component reads files from disk.

return (path.name, path.read_bytes())
return pathlib.Path(file).read_bytes()
return (path.name, await path.read_bytes())
return await anyio.Path(file).read_bytes()
return b64encode(file, file.read_bytes())
return b64encode(file, await anyio.Path(file).read_bytes())
contents = Path(path).read_bytes()
files.append((path.relative_to(relative_to).as_posix(), path.read_bytes()))
files.append((path.relative_to(relative_to).as_posix(), await path.read_bytes()))
name = (_config_dir() / "active_config").read_text(encoding="utf-8").strip()
creds: Dict[str, Any] = _wrap_secret_fields(json.loads(path.read_text(encoding="utf-8")))
content = self._path.read_text(encoding="utf-8").strip()
return path.read_bytes().decode("utf-8")
data = base64.standard_b64encode(target.read_bytes()).decode("ascii")

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

MEDIUMPython filesystem write/deleteST-FS-PY-WRITE

The component writes or deletes files on disk.

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.

MEDIUMPython network egressST-NET-PY

The component makes outbound network requests.

from urllib.request import getproxies
from aiohttp import BasicAuth, ClientTimeout
from aiohttp.client import ClientResponse, ClientSession
connector = aiohttp.UnixConnector(
                    path=self.uds,
                    keepalive_timeout=self.limits.keepalive_expiry,
                    **limit_kwarg,  # type: ignore
                )
connector = aiohttp.TCPConnector(
                    keepalive_timeout=self.limits.keepalive_expiry,
                    ssl=self.ssl_context,
                    local_addr=(self.local_address, 0) if self.local_address else None, …
return ClientSession(connector=connector)
timeout=ClientTimeout(
                    sock_connect=timeout.get("connect"),
                    sock_read=timeout.get("read"),
                    connect=timeout.get("pool"),
                ),
proxy_auth=BasicAuth(self.proxy.auth[0], self.proxy.auth[1])

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.

LOWDelegated authentication (OAuth 2.0 / OIDC)ST-AUTH-DELEGATED

An OAuth 2.0 / OpenID Connect delegated-authentication flow was detected (authorization-code / refresh-token / token-exchange grant, an OIDC authorize/discovery endpoint or id_token, or a delegation library). Tools authenticate with the end user's delegated, scoped credentials rather than a long-lived embedded service credential. (7 occurrence(s) shown as evidence).

# by default, so new fields (id_token, client_secret, ...) are wrapped without

Fix: Delegated auth is a lower-blast-radius execution context than an embedded static credential. Confirm the requested scopes are minimal and that tokens are never logged or forwarded off-host.

LOWScoped / least-privilege identityST-AUTH-SCOPED

A short-lived, scoped, assumed identity was detected — an STS AssumeRole / session token, a cloud managed or workload identity, an impersonated service account, a projected Kubernetes service-account token, or a dynamic-secret broker. Tools authenticate with a narrowly-scoped credential that expires, rather than a long-lived embedded service credential. (24 occurrence(s) shown as evidence).

or the workload-identity env trio). Per the credential-precedence spec,
f"{ENV_IDENTITY_TOKEN} is not set; the workload-identity chain "
creator is not recorded (legacy, workload-identity-federated, or system-created
creator is not recorded (legacy, workload-identity-federated, or system-created

Fix: A scoped, short-lived identity is the smallest-blast-radius execution context. Confirm the assumed role / requested scope grants only the permissions the tool needs, and that the token lifetime is minimal.

LOWMCP tool surface detectedST-MCP-DETECTED

An MCP tool surface (manifest or tool definitions) was found.

raise RuntimeError("Cannot call a synchronous function asynchronously. Use `@tool` instead.")

Why it matters: Just context — review which tools it offers and their permissions.

Fix: Review the declared MCP tools and their permissions.

Check your own component

Run the same evidence-backed scan on any MCP server, agent skill, or package.

Scan your own component

How we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →