flag-schedule

Pass

Audited by Gen Agent Trust Hub on Jul 7, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: Indirect prompt injection surface identified. The skill ingests feature flag data from the GrowthBook API.
  • Ingestion points: Data retrieved via gb-call GET in Workflow Path A and B of SKILL.md.
  • Boundary markers: No markers are used to isolate untrusted data.
  • Capability inventory: Modification of flag states via gb-call POST and PUT in SKILL.md.
  • Sanitization: No explicit data sanitization.
  • [COMMAND_EXECUTION]: Executes shell commands via the bundled gb-call helper script to interact with the GrowthBook API.
  • [SAFE]: Secret management instructions encourage the use of environment variables or local configuration files, avoiding hardcoded credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 7, 2026, 02:28 PM
Security Audit — agent-trust-hub — flag-schedule