launchdarkly-experiment-guide
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is authored by 'launchdarkly' and interacts exclusively with official LaunchDarkly infrastructure, including the official MCP server and API endpoints (
app.launchdarkly.com). - [SAFE]: The skill implements a robust 'fail-fast' mechanism in Step 0, ensuring that LaunchDarkly connectivity and specific capabilities (metric/experiment creation) are verified before performing any discovery or drafting work.
- [SAFE]: The instructions explicitly forbid the agent from searching for credentials in local environment variables,
.envfiles, or configuration files. Instead, it requires the user to manually paste an API token for the session if the MCP is unavailable, which is a secure practice for ephemeral token handling. - [SAFE]: All write operations (creating metrics, flags, or experiments) require explicit user confirmation after presenting a full draft of the intended changes. This prevents unauthorized or accidental modifications to the user's LaunchDarkly account.
- [SAFE]: The codebase scanning is limited to high-level metadata (
package.json,README) and git history (git log) to infer product context. It does not perform deep audits or exfiltrate sensitive source code. - [SAFE]: The skill uses delegation to other modular LaunchDarkly skills (
launchdarkly-metric-create,launchdarkly-flag-create), promoting a clear separation of concerns and reuse of existing logic.
Audit Metadata