custom-metrics

Warn

Audited by Gen Agent Trust Hub on Jun 12, 2026

Risk Level: MEDIUMDATA_EXFILTRATION
Full Analysis
  • [DATA_EXFILTRATION]: Accesses the local Claude configuration file to harvest credentials.
  • Evidence: The get_launchdarkly_api_key function in SKILL.md reads from Path.home() / ".claude" / "config.json" to retrieve LAUNCHDARKLY_API_KEY.
  • [DATA_EXFILTRATION]: Accesses system environment variables to retrieve authentication tokens.
  • Evidence: The code checks for LAUNCHDARKLY_API_KEY, LAUNCHDARKLY_API_TOKEN, and LD_API_KEY using os.environ.get().
  • [SAFE]: Communicates with official LaunchDarkly API endpoints for metric lifecycle management.
  • Evidence: Uses the requests library to interact with https://app.launchdarkly.com/api/v2/metrics/.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 12, 2026, 08:05 PM
Security Audit — agent-trust-hub — custom-metrics