configs-create

Pass

Audited by Gen Agent Trust Hub on Jun 12, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill facilitates the creation of AI configurations by interpolating user-provided text into instructions and messages. This creates a surface for indirect prompt injection. 1. Ingestion points: User-supplied use cases and agent goals (SKILL.md). 2. Boundary markers: None implemented for the interpolated content. 3. Capability inventory: Resource creation via setup-ai-config MCP tool and direct REST API calls (SKILL.md). 4. Sanitization: No explicit filtering or validation of the injected text is defined.- [COMMAND_EXECUTION]: The skill provides instructions for using curl, jq, and the LaunchDarkly CLI (ldcli) to perform administrative tasks such as verifying configuration state and updating targeting fallthroughs. These tools are used as intended by the vendor.- [DATA_EXFILTRATION]: Utilizes the LD_API_KEY environment variable for authorized authentication with the official LaunchDarkly API. This usage is restricted to legitimate administrative operations on the vendor's platform.- [EXTERNAL_DOWNLOADS]: Interacts with app.launchdarkly.com, which is a well-known service domain belonging to the skill's author. No untrusted or unknown external sources are referenced.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 12, 2026, 08:05 PM
Security Audit — agent-trust-hub — configs-create