The Agent Skills Directory

[DATA_EXFILTRATION]: The skill performs network operations using the gb-call helper script to interact with GrowthBook's official API endpoints (/api/v2/features, /api/v1/environments). These operations are restricted to the vendor's infrastructure and are necessary for the skill's primary purpose.
[DATA_EXFILTRATION]: The skill identifies ~/.config/growthbook/.env as a location for storing the GB_API_KEY. This is documented as a standard practice for local configuration and secret management, not as an attempt to expose or leak credentials.
[INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface where it reads feature flag details (rules and environment settings) from the GrowthBook API. While this data is used to inform the agent's response and confirmation steps, the risk is minimal as it originates from the user's own configured GrowthBook account.
Ingestion points: Data is fetched from GET /api/v2/features/<flag-id> in SKILL.md (Workflow Step 1).
Boundary markers: None explicitly defined for the API response content.
Capability inventory: The skill uses gb-call for authorized API interaction; no arbitrary shell execution or file system writes (outside of the referenced setup skill) are present.
Sanitization: None explicitly mentioned for the API data processing.

flag-toggle