flag-prerequisites
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute a bundled helper script (
gb-call) for interacting with GrowthBook APIs. This is standard functionality for the skill's purpose of managing feature flag prerequisites. - [DATA_EXPOSURE]: References the storage of API keys in a local configuration file (
~/.config/growthbook/.env). This is documented as a standard practice for the GrowthBook integration and does not involve unauthorized access or exfiltration. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the GrowthBook API to reconstruct configuration arrays. While it lacks explicit boundary markers for the data returned from the API, the operations are limited to structured JSON manipulation for flag management, representing a low-risk surface typical of configuration tools.
Audit Metadata