configs-targeting
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructs the agent to search for the LAUNCHDARKLY_API_KEY within the ~/.claude/config.json file. This involves reading a sensitive configuration file from the agent's host environment to facilitate authentication with the LaunchDarkly service.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for translating natural language user requests into API calls for managing targeting rules, which creates a surface where user-supplied strings are interpolated into API payloads.
- Ingestion points: User-provided descriptions and attribute values for targeting logic in SKILL.md.
- Boundary markers: No specific delimiters or instructions are provided to the agent to treat user data as untrusted content.
- Capability inventory: The skill utilizes curl and the Python requests library to perform network writes to the app.launchdarkly.com domain.
- Sanitization: No sanitization or validation logic is defined in the provided Python implementation or command-line examples.
Audit Metadata