claude-api
“Build, debug, and optimize Claude API / Anthropic SDK apps. Apps built with this skill should include prompt caching. Also handles migrating existing Claude API code between Claude model versions (4.5 → 4.6, 4.6 → 4.7, retired-model replacements). TRIGGER when: code imports `anthropic`/`@anthropic-ai/sdk`; user asks for the Claude API, Anthropic SDK, or Managed Agents; user adds/modifies/tunes a Claude feature (caching, thinking, compaction, tool use, batch, files, citations, memory) or model (Opus/Sonnet/Haiku) in a file; questions about prompt caching / cache hit rate in an Anthropic SDK project. SKIP: file imports `openai`/other-provider SDK, filename like `*-openai.py`/`*-generic.py`, provider-neutral code, general programming/ML.”
csharp
curl
go
managed-agents
java
managed-agents
php
managed-agents
python
claude-api
managed-agents
ruby
managed-agents
shared
typescript
claude-api
managed-agents
aipkg.jsoncsharp/claude-api.mdcurl/examples.mdcurl/managed-agents.mdgo/claude-api.mdgo/managed-agents/README.mdjava/claude-api.mdjava/managed-agents/README.mdLICENSE.txtphp/claude-api.mdphp/managed-agents/README.mdpython/claude-api/batches.mdpython/claude-api/files-api.mdpython/claude-api/README.mdpython/claude-api/streaming.mdpython/claude-api/tool-use.mdpython/managed-agents/README.mdREADME.mdruby/claude-api.mdruby/managed-agents/README.mdshared/agent-design.mdshared/error-codes.mdshared/live-sources.mdshared/managed-agents-api-reference.mdshared/managed-agents-client-patterns.mdshared/managed-agents-core.mdshared/managed-agents-environments.mdshared/managed-agents-events.mdshared/managed-agents-memory.mdshared/managed-agents-multiagent.mdshared/managed-agents-onboarding.mdshared/managed-agents-outcomes.mdshared/managed-agents-overview.mdshared/managed-agents-self-hosted-sandboxes.mdshared/managed-agents-tools.mdshared/managed-agents-webhooks.mdshared/model-migration.mdshared/models.mdshared/prompt-caching.mdshared/tool-use-concepts.mdSKILL.mdtypescript/claude-api/batches.mdtypescript/claude-api/files-api.mdtypescript/claude-api/README.mdtypescript/claude-api/streaming.mdtypescript/claude-api/tool-use.mdtypescript/managed-agents/README.md- 01SQP-290%HIGH
curl/managed-agents.md:8
detailhide
The setup example shows exporting an API key as a shell variable without any security warning or guidance on protecting secrets. This pattern teaches users to handle credentials insecurely, increasing the risk of accidental exposure in shell history, process listings, or shared terminal sessions.
0607```bash08export ANTHROPIC_API_KEY="your-api-key"0910# Common headersfix Add a prominent security warning before the setup section advising users to use secure credential management (environment files, credential managers, or secrets vaults). Show how to load API keys safely from `.env` files with appropriate access controls. Never show bare `export` of secrets in documentation examples.
- 02SQP-285%HIGH
curl/managed-agents.md:119
detailhide
The GitHub authorization token (ghp_...) is shown as a direct parameter in the cURL example without any security guidance. This teaches users to pass credentials in plaintext through command-line arguments, where they may be exposed in shell history, process listings, or log files.
117 "url": "https://github.com/owner/repo",118 "mount_path": "/workspace/repo",119 "authorization_token": "ghp_...",120 "branch": "feature-branch"121 }fix Add a security warning that GitHub tokens should never be passed directly on the command line. Recommend storing the token in an environment variable or using GitHub's credential management tools. Show the example using a variable reference instead of a literal token string.
- 03SQP-295%HIGH
java/managed-agents/README.md:358
detailhide
The README contains multiple hardcoded sensitive tokens and credentials in code examples, including OAuth access tokens (xoxp-...), refresh tokens (xoxe-1-...), client secrets, and GitHub personal access tokens (ghp_...). These are presented as working examples that developers may copy directly into their code, creating a high risk of accidental credential exposure in version control systems, logs, and shared repositories.
356 .type(BetaManagedAgentsMcpOAuthCreateParams.Type.MCP_OAUTH)357 .mcpServerUrl("https://mcp.slack.com/mcp")358 .accessToken("xoxp-...")359 .expiresAt(OffsetDateTime.parse("2026-04-15T00:00:00Z"))360 .refresh(BetaManagedAgentsMcpOAuthRefreshParams.builder()fix Replace all concrete credential examples with placeholder values clearly marked as examples (e.g., 'xoxp-your-token', 'ghp_example_token'). Add prominent warnings before each credential section stating 'Never hardcode credentials. Use environment variables, secure vaults, or credential managers.' Provide separate secure credential management examples showing how to load tokens from environment variables or configuration files.
- 04SQP-285%MEDIUM
ruby/claude-api.md:20
detailhide
The code example shows an API key being passed as a string literal ('your-api-key') in production code. While this is a placeholder string, it demonstrates a dangerous pattern that users may replicate with their actual API keys, leading to credential exposure in version control systems, logs, or public repositories. This is particularly risky for documentation that serves as a template for developers.
1819# Explicit API key20client = Anthropic::Client.new(api_key: "your-api-key")21```22fix Update the example to explicitly show loading the API key from environment variables only: client = Anthropic::Client.new(api_key: ENV['ANTHROPIC_API_KEY']). Add a comment explaining never to hardcode API keys. Consider adding a warning block at the top of the documentation: 'Never commit API keys to version control. Always use environment variables or secure secret management.'
- 05SQP-285%HIGH
typescript/claude-api/README.md:18
detailhide
The code example at line 18 shows explicit API key hardcoding with the comment `// Explicit API key` and a literal string `"your-api-key"`. While this is a teaching example with a placeholder string, it patterns dangerous practice and could mislead developers into committing real API keys to version control. The placement in a README without warnings about credential management increases risk.
1617// Explicit API key18const client = new Anthropic({ apiKey: "your-api-key" });19```20fix Remove the hardcoded API key example or replace it with explicit guidance on environment variables. Add a clear security warning: 'Never hardcode API keys in source code. Always use environment variables or a secrets manager.' Reference the ANTHROPIC_API_KEY environment variable pattern shown above and add an example using a secrets library (e.g., dotenv).
- 06SQP-272%MEDIUM
typescript/claude-api/README.md:1
detailhide
The README provides comprehensive API integration examples but lacks consistent security warnings about sensitive operations. Multiple sections (System Prompts, Vision, Caching, Multi-Turn Conversations) involve processing user data and maintaining conversation history without discussing data privacy, PII handling, or secure log practices. This omission could lead developers to inadvertently expose sensitive information.
1# Claude API — TypeScript23## Installationfix Add a prominent 'Security Considerations' section early in the README covering: (1) never log API keys or responses containing PII, (2) sanitize user inputs before sending to API, (3) implement data retention policies, (4) use environment variables for all credentials, (5) consider encryption for stored conversation history.