{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-24","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Imports Claude-created skills into your Expertise account. Preview the planned import, upload selected skill files and re-import later revisions. Unchanged content is skipped; an Expertise account is required.","did":"b9ee34f3-cbb0-4a03-8f18-a846b694ccbf","documentation_url":"https://docs.expertise.ai/expertise/agent-connector","editorial_description":{"extended_description":"Imported skills appear in your Expertise dashboard for team use and sharing. Tools list earlier imports and their links. The connector is limited to the files you select, not unrelated files, chat history or memory.","schema_version":1,"summary":"Imports Claude-created skills into your Expertise account.\nPreview the planned import, upload selected skill files and re-import later revisions.\nUnchanged content is skipped; an Expertise account is required."},"homepage_url":"","icon":"","id":"b9ee34f3-cbb0-4a03-8f18-a846b694ccbf","installs":0,"last_scanned":"","license":"","long_description":"Imported skills appear in your Expertise dashboard for team use and sharing. Tools list earlier imports and their links. The connector is limited to the files you select, not unrelated files, chat history or memory.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"Official docs say the connector packs local skill folders and uploads them to Expertise; imported skills land disabled for dashboard review.","reasoning":"Uploading local skill content creates persistent records in a third-party workspace and reads selected local files.","risk_type":"file_write","severity":"medium","title":"Imports local skills into Expertise","triggering_tools_or_skills":["expertise_plan_import","expertise_start_import"]},{"evidence":"The docs say re-import updates changed skills and flags them for review while unchanged skills are left alone.","reasoning":"The connector modifies the user's private Expertise skill library, although it cannot publish or alter earnings/profile data.","risk_type":"data_modification","severity":"medium","title":"Updates previously imported skills","triggering_tools_or_skills":["expertise_import_skill","expertise_start_import"]}],"assessment_status":"provisional","auth_and_scopes":"OAuth connection grants a single import-skills permission according to official docs and can be revoked immediately.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/b9ee34f3-cbb0-4a03-8f18-a846b694ccbf.json","what_it_proves":"Candidate PR #125 record identity (name \"Expertise AI\", publisher, type web_connector) and 4 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/b9ee34f3-cbb0-4a03-8f18-a846b694ccbf: complete tool_names inventory (4 tools), remote streamable-http endpoint https://my.expertise.ai/assist-api/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T20:52:23Z","url_or_path":"https://docs.expertise.ai/expertise/agent-connector","what_it_proves":"Official docs define the one-permission import flow, local skill upload, review state and inability to publish."}],"primary_reason":"Expertise AI imports and updates local skill folders in a private review queue.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:b9ee34f3-cbb0-4a03-8f18-a846b694ccbf","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 4 tools and official docs. The connector cannot publish; going live remains a separate dashboard click. Runtime verification should confirm the fixed upload script cannot select files outside the intended skill folders.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"false","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":4,"tools_or_skills_total":4},"name":"Expertise AI","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=b9ee34f3-cbb0-4a03-8f18-a846b694ccbf&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.expertise.ai/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Expertise AI","publisher_url":"https://www.expertise.ai/","remote_url":"https://my.expertise.ai/assist-api/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, change, export, or otherwise write files. Review findings: Uploading local skill content creates persistent records in a third-party workspace and reads selected local files.","evidence":"Imports local skills into Expertise: Official docs say the connector packs local skill folders and uploads them to Expertise; imported skills land disabled for dashboard review.","manual_risk_type":"file_write","remediation":{"block_tool_categories":["state_change"],"steps":["Limit file access to a dedicated working directory.","Review generated or modified files before they are shared or executed."]},"risk_type":"filesystem_access","severity":"medium","title":"Imports local skills into Expertise","triggering_tools":["expertise_plan_import","expertise_start_import"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: The connector modifies the user's private Expertise skill library, although it cannot publish or alter earnings/profile data.","evidence":"Updates previously imported skills: The docs say re-import updates changed skills and flags them for review while unchanged skills are left alone.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Updates previously imported skills","triggering_tools":["expertise_import_skill","expertise_start_import"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@expertise.ai","tags":["filesystem_access","modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"expertise_import_skill","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: The connector modifies the user's private Expertise skill library, although it cannot publish or alter earnings/profile data."}},{"description":"","name":"expertise_list_imported"},{"description":"","name":"expertise_plan_import","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: Uploading local skill content creates persistent records in a third-party workspace and reads selected local files."}},{"description":"","name":"expertise_start_import","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: The connector modifies the user's private Expertise skill library, although it cannot publish or alter earnings/profile data."}}],"tools_count":4,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/b9ee34f3-cbb0-4a03-8f18-a846b694ccbf","uuid":"51552055-0a6e-5102-a738-bf91a45b7639","verification_tier":"community","version":""},"query_key":"expertise ai","schema_version":1,"status":"match"}