launchdarkly-flag-create
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill identifies and processes local code files to understand existing flag usage, which represents a potential attack surface.
- Ingestion points: Local codebase files including dependency manifests (package.json, go.mod, etc.) and source code (SKILL.md Step 1).
- Boundary markers: No explicit instruction for the agent to treat ingested code as untrusted or to use delimiters to prevent instruction leakage.
- Capability inventory: The skill utilizes MCP tools to create and update flags and modifies source code to insert flag evaluation logic (SKILL.md Step 3 & 4).
- Sanitization: The skill lacks explicit sanitization or escaping instructions for data read from the codebase.
Audit Metadata