backend-feature-flags
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a comprehensive technical guide focused on the design and implementation of feature flag systems. It follows standard security and operational practices for high-availability systems.
- [DATA_EXPOSURE_AND_EXFILTRATION]: No sensitive data access or unauthorized exfiltration was identified. The skill correctly instructs developers to use environment variables for sensitive API keys (e.g.,
process.env.LAUNCHDARKLY_SDK_KEY) and provides placeholders for internal tokens (e.g.,*:*.unleash-internal-api-token). These are standard implementation patterns and do not represent a security risk. - [REMOTE_CODE_EXECUTION]: The skill mentions and provides examples for official SDKs from well-known services like LaunchDarkly, Unleash, and Flagsmith. No unverified remote script downloads or execution patterns (e.g., pipe to shell) were found.
- [DYNAMIC_EXECUTION]: The code snippets provided for flag evaluation are static and use deterministic hashing (murmur3_32) for percentage rollouts. No unsafe use of eval, exec, or untrusted deserialization was detected.
- [PROMPT_INJECTION]: The skill's trigger phrases and instructions are well-defined and do not contain patterns intended to bypass agent safety filters or override system instructions.
- [SAFE_PRACTICE]: The skill explicitly includes security-focused requirements such as mandatory flag ownership, removal dates to prevent technical debt, and the requirement for kill switches for all critical features, which is a key resiliency pattern.
Audit Metadata