launchdarkly-flag-command
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the
@launchdarkly/mcp-serverpackage, as defined inmarketplace.json. This is an official resource used to provide the toolset for feature flag interaction. - [COMMAND_EXECUTION]: The workflow involves calling Model Context Protocol (MCP) tools such as
list-flagsandget-flag. These tools are restricted to read-only lookups by the instructions inSKILL.md, and the skill explicitly forbids any write operations (create, toggle, update, or delete). - [PROMPT_INJECTION]: The skill contains robust guardrails in the 'Scope Boundary' section, explicitly instructing the agent to refuse requests for flag modification or staleness analysis. It mandates a specific routing message when users inquire about flag removal, ensuring the agent does not improvise safety conclusions.
- [PROMPT_INJECTION]: Assessment of Indirect Prompt Injection risk surface:
- Ingestion points: Data ingested from
list-flagsandget-flagtool outputs (SKILL.md). - Boundary markers: Not explicitly defined in the skill instructions.
- Capability inventory: Restricted to read-only operations and routing to other local skill files; no write-access, file-system manipulation, or arbitrary code execution capabilities are present.
- Sanitization: No specific sanitization logic is described in the instructions, though risk is mitigated by the limited read-only capability set.
Audit Metadata