flag-rules
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a local helper script located at
${CLAUDE_PLUGIN_ROOT}/scripts/gb-callto perform API operations. This tool is explicitly scoped in the frontmatter and used for legitimate administrative tasks. - [CREDENTIALS_UNSAFE]: The skill references the environment variable
GB_API_KEYand the configuration file~/.config/growthbook/.env. This is a standard practice for managing API keys for the GrowthBook service and does not represent an unsafe exposure or hardcoding of secrets. - [DATA_EXFILTRATION]: Network operations are restricted to interactions with the GrowthBook API endpoints (e.g.,
/api/v2/features/). This behavior is consistent with the skill's stated purpose of managing feature flags and does not target unauthorized or suspicious domains. - [EXTERNAL_DOWNLOADS]: The skill does not perform any external downloads or execute remote scripts. All operations are handled by local bundled code.
Audit Metadata