The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a bundled script located at ${CLAUDE_PLUGIN_ROOT}/scripts/gb-call to communicate with GrowthBook APIs. These operations are restricted to the vendor's own infrastructure.
[DATA_EXPOSURE]: The skill reads from ~/.config/growthbook/.env to retrieve configuration and the GB_API_KEY. This is documented as the standard local configuration path for GrowthBook integration.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data including flag definitions, project attributes, and saved groups from the GrowthBook API.
Ingestion points: API responses from GET /api/v2/features/:id, GET /api/v1/attributes, and GET /api/v1/saved-groups are loaded into the agent context.
Boundary markers: The instructions lack explicit XML-style delimiters for API data, but use structured presentation formats.
Capability inventory: The skill can perform network operations via gb-call (POST/PUT/DELETE) to mutate remote flag state.
Sanitization: The skill includes explicit instructions to validate user-provided attribute names against the fetched list and to serialize conditions as JSON strings, which provides a layer of input validation.

flag-targeting