built-in-metrics
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides code templates for instrumenting AI provider calls, creating a surface where the agent-generated code may process untrusted data.
- Ingestion points: Code examples in
references/openai-tracking.md,references/anthropic-tracking.md,references/gemini-tracking.md, andreferences/strands-tracking.mddemonstrate passinguser_promptoruser_inputvariables directly into model invocation functions. - Boundary markers: The provided templates do not include delimiters or instructions to ignore embedded prompts within the user-supplied data.
- Capability inventory: The instrumented code possesses the capability to perform network requests to external AI provider APIs (OpenAI, Anthropic, Gemini, Bedrock).
- Sanitization: The skill's instructions and references do not demonstrate or recommend sanitization, validation, or filtering of the untrusted input before processing.- [COMMAND_EXECUTION]: The skill documents how to interact with the LaunchDarkly REST API and external AI services using standard developer tools.
- Evidence:
references/metrics-api.mdandreferences/langchain-tracking.mdprovide examples usingrequestsandcurlto interact withapp.launchdarkly.com. These operations target vendor-owned infrastructure and well-known services, and are documented neutrally.
Audit Metadata