flag-schedule
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: Indirect prompt injection surface identified. The skill ingests feature flag data from the GrowthBook API.
- Ingestion points: Data retrieved via gb-call GET in Workflow Path A and B of SKILL.md.
- Boundary markers: No markers are used to isolate untrusted data.
- Capability inventory: Modification of flag states via gb-call POST and PUT in SKILL.md.
- Sanitization: No explicit data sanitization.
- [COMMAND_EXECUTION]: Executes shell commands via the bundled gb-call helper script to interact with the GrowthBook API.
- [SAFE]: Secret management instructions encourage the use of environment variables or local configuration files, avoiding hardcoded credentials.
Audit Metadata