apply
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFECREDENTIALS_UNSAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [SAFE]: The skill is authored by the official vendor and follows industry standards for secure SDK onboarding.
- [CREDENTIALS_UNSAFE]: The skill explicitly instructs against hardcoding SDK keys, client-side IDs, or mobile keys. It implements a mandatory decision point (D7) that requires user consent before secrets are written to any location. It also enforces the use of
.gitignorefor environment files containing real secrets, which is a recognized safe practice for secret management. - [COMMAND_EXECUTION]: The skill uses project package managers to install dependencies. It includes a specific safeguard (D8) requiring explicit user approval before modifying any packages or configurations outside the primary SDK scope, preventing unauthorized modifications to the project's dependency tree.
- [DATA_EXFILTRATION]: The skill utilizes a vendor-specific MCP tool to retrieve necessary keys from the LaunchDarkly platform. It mandates that keys be handled as sensitive data and only written to locations explicitly chosen by the user, while specifically warning the agent not to echo key values in conversation logs to prevent accidental exposure.
Audit Metadata