flag-review
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill retrieves the
GB_API_KEYfrom a local configuration file at~/.config/growthbook/.env. This is a standard and safe method for managing API credentials for the GrowthBook service. - [PROMPT_INJECTION]:
- Ingestion points: Fetches feature flag draft revisions and current state from the GrowthBook API (SKILL.md).
- Boundary markers: No explicit delimiters are present for isolating API data within the prompt.
- Capability inventory: Interacts with the GrowthBook API via
gb-calland opens URLs in the system browser. - Sanitization: API response content is used directly without sanitization.
Audit Metadata