flag-default-value
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
gb-callhelper script to interact with the GrowthBook API. This tool is explicitly defined in the allowed-tools configuration and is used for its intended administrative purpose.\n- [DATA_EXFILTRATION]: The skill mentions the configuration file~/.config/growthbook/.envfor API key management. This is consistent with local CLI tool standards and does not indicate unauthorized data access or exfiltration.\n- [PROMPT_INJECTION]: The workflow involves ingesting user-provided flag IDs and values. While this creates a surface for potential injection, the skill mitigates risks by instructing the agent to perform type validation and require manual user confirmation before publishing changes to production.\n - Ingestion points: User-provided inputs for Flag IDs and default values in the workflow steps.\n
- Boundary markers: Use of JSON payloads for API communication.\n
- Capability inventory: API interaction via the
gb-callscript inSKILL.md.\n - Sanitization: Explicit instructions for value type validation and mandatory user confirmation before publishing.
Audit Metadata