built-in-metrics

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill provides code templates for instrumenting AI provider calls, creating a surface where the agent-generated code may process untrusted data.
  • Ingestion points: Code examples in references/openai-tracking.md, references/anthropic-tracking.md, references/gemini-tracking.md, and references/strands-tracking.md demonstrate passing user_prompt or user_input variables directly into model invocation functions.
  • Boundary markers: The provided templates do not include delimiters or instructions to ignore embedded prompts within the user-supplied data.
  • Capability inventory: The instrumented code possesses the capability to perform network requests to external AI provider APIs (OpenAI, Anthropic, Gemini, Bedrock).
  • Sanitization: The skill's instructions and references do not demonstrate or recommend sanitization, validation, or filtering of the untrusted input before processing.- [COMMAND_EXECUTION]: The skill documents how to interact with the LaunchDarkly REST API and external AI services using standard developer tools.
  • Evidence: references/metrics-api.md and references/langchain-tracking.md provide examples using requests and curl to interact with app.launchdarkly.com. These operations target vendor-owned infrastructure and well-known services, and are documented neutrally.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 08:08 AM