launchdarkly-flag-qualitative-feedback-setup
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed as a structured wizard that requires explicit user confirmation at critical steps, specifically before any code is generated or applied to the filesystem.
- [EXTERNAL_DOWNLOADS]: The skill interacts with the official LaunchDarkly MCP server and references standard LaunchDarkly SDK packages. These are resources provided by the verified author and do not constitute a security risk.
- [DYNAMIC_EXECUTION]: The skill generates project-specific code (utility functions and React components) by adapting provided templates to the user's design system. This code generation is the primary purpose of the skill and is subject to user review and standard build-time checks.
- [INDIRECT_PROMPT_INJECTION]: The skill manages a potential injection surface by ingesting user-defined prompt strings and project metadata.
- Ingestion points: Project source code (to detect SDKs/frameworks) and user input (for feedback prompt text).
- Boundary markers: The workflow uses explicit questions and re-summarizes requirements before implementation to ensure intent alignment.
- Capability inventory: The skill writes new TypeScript/React files to the local project directory.
- Sanitization: The generated
sendFeedback.tsutility includes logic to truncate user-submitted feedback and prompt text to a maximum of 4096 characters, preventing potential payload-based issues.
Audit Metadata