custom-metrics
Warn
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: MEDIUMDATA_EXFILTRATION
Full Analysis
- [DATA_EXFILTRATION]: Accesses the local Claude configuration file to harvest credentials.
- Evidence: The
get_launchdarkly_api_keyfunction inSKILL.mdreads fromPath.home() / ".claude" / "config.json"to retrieveLAUNCHDARKLY_API_KEY. - [DATA_EXFILTRATION]: Accesses system environment variables to retrieve authentication tokens.
- Evidence: The code checks for
LAUNCHDARKLY_API_KEY,LAUNCHDARKLY_API_TOKEN, andLD_API_KEYusingos.environ.get(). - [SAFE]: Communicates with official LaunchDarkly API endpoints for metric lifecycle management.
- Evidence: Uses the
requestslibrary to interact withhttps://app.launchdarkly.com/api/v2/metrics/.
Audit Metadata