The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a bundled helper script ${CLAUDE_PLUGIN_ROOT}/scripts/gb-call to perform specific API operations. This is a controlled execution environment limited to interacting with the GrowthBook platform.
[DATA_EXPOSURE]: The instructions reference the use of ~/.config/growthbook/.env for storing the GB_API_KEY. This is consistent with standard secret management practices for GrowthBook tooling and does not involve unauthorized exfiltration.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests data from the GrowthBook API (e.g., metric names, datasource IDs) which is then used to construct subsequent API requests.
Ingestion points: Data retrieved from GET /api/v1/data-sources and GET /api/v1/fact-metrics (SKILL.md).
Boundary markers: None explicitly defined for API response processing.
Capability inventory: Write access to feature flags and ramp schedules via PUT and POST requests through the gb-call tool (SKILL.md).
Sanitization: The skill uses structured JSON payloads for API interactions, which provides inherent structure but no explicit sanitization of field values is documented.

flag-monitoring