configs-create
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8). It instructs the agent to populate LaunchDarkly configuration fields, such as 'instructions' for agent mode or 'messages' for completion mode, using context and content provided by the user. There is no guidance for sanitizing this input or using boundary markers to prevent the agent from following instructions embedded within the user data.
- Ingestion points: User requests and context used to define configuration logic and content (SKILL.md).
- Boundary markers: Absent.
- Capability inventory: MCP tools (setup-ai-config, create-ai-config, create-ai-config-variation) and suggested shell commands (SKILL.md).
- Sanitization: No sanitization or validation of user-provided text content is described.
- [COMMAND_EXECUTION]: The skill provides command-line templates using 'curl' and 'ldcli' for updating LaunchDarkly configuration targeting. These commands are intended to be executed in the agent's environment and utilize the '$LD_API_KEY' environment variable for authentication with the official LaunchDarkly API (app.launchdarkly.com).
Audit Metadata