launchdarkly-metric-create
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill is a legitimate development tool provided by LaunchDarkly to help users integrate their platform's metric and experimentation capabilities into their codebase.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of official, well-known LaunchDarkly SDK packages (launchdarkly-react-client-sdk, launchdarkly-js-client-sdk, @launchdarkly/node-server-sdk) from standard public registries.
- [COMMAND_EXECUTION]: The skill uses standard package management tools (npm, yarn, pnpm) to install necessary libraries and modifies local application files such as .env and source code to configure the SDK and track events.
- [SAFE]: The skill identifies a potential surface for indirect data processing without evidence of malicious intent:
- Ingestion points: The skill reads local source files, dependency manifests (package.json), and environment files, while also accepting user-provided event keys, URL match rules, and CSS selectors. (File: SKILL.md)
- Boundary markers: No explicit boundary markers or delimiters are specified for separating untrusted user input from generated code or API payloads.
- Capability inventory: The skill possesses the capability to modify local configuration and source files, execute CLI commands for package installation, and perform network operations via the LaunchDarkly MCP server tools.
- Sanitization: The instructions do not describe specific sanitization or validation steps for external inputs before they are interpolated into the local codebase or tool calls.
Audit Metadata