[Feat] New API - Claude Skills API (Anthropic)

[ishaan-jaff]

[Feat] New API - Claude Skills API (Anthropic)

Usage Examples

Create Skill

curl "http://localhost:4000/v1/skills?beta=true" \
  -X POST \
  -H "Authorization: Bearer sk-1234" \
  -F "display_title=My Custom Skill" \
  -F "files[][email protected]"

List skills

curl "http://localhost:4000/v1/skills?beta=true&limit=10" \
  -H "Authorization: Bearer sk-1234"### Get Skill

Delete Skill

curl "http://localhost:4000/v1/skills/skill_123?beta=true" \
  -H "Authorization: Bearer sk-1234"### Delete Skill

Relevant issues

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have Added testing in the tests/litellm/ directory, Adding at least 1 test is a hard requirement - see details
• I have added a screenshot of my new test passing locally
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible, it only solves 1 specific problem

Type

🆕 New Feature
✅ Test

Changes

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
litellm	Ready	Preview	Comment	Nov 24, 2025 11:00pm

We should avoid logging the full URL (which may contain sensitive information from the secret manager) in cleartext.
The best fix is to sanitize the value before logging, such as by redacting the potentially sensitive portion of the URL or by omitting the log statement entirely.
The minimal-impact approach:

• In transform_get_skill_request, replace the debug statement on line 166 that logs url with a safe log.
  Options:
• (a) Do not log the URL at all (simplest/safest).
• (b) Log a sanitized version of the URL, e.g., mask or omit the API base portion.

To preserve the existing functionality and logging context, and assuming the rest of the codebase does not require this log, we will simply remove or redact the sensitive component.

Edit required:

• In litellm/llms/anthropic/skills/transformation.py, in transform_get_skill_request, replace line 166:
  • Option 1: Remove the logging statement altogether.
  • Option 2: Log only the path/endpoint, not the full url.

Given only the code shown, the safest route is simply removing the debug statement that logs the full URL.

To address this vulnerability, we must prevent direct logging of potentially sensitive information, in this case the full API URL including the base. The recommended solution is to remove or sanitize the logging statement, so any output does not reveal the API base (or other secrets), but still allows useful logging (such as endpoint and skill ID).

Best approach:
In transform_delete_skill_request, replace

verbose_logger.debug("Delete skill request - URL: %s", url)

with a log statement that only includes safe metadata (e.g., the endpoint and skill ID, not the API base). For instance:

verbose_logger.debug("Delete skill request - Endpoint: skills, Skill ID: %s", skill_id)

This maintains sufficient context for debugging without risking secret leakage.

Changes needed:

• Directly edit the affected logging line at line 195 in litellm/llms/anthropic/skills/transformation.py.
• No imports or new methods are necessary.

---