projects

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references several well-known libraries in its implementation guides, including requests, python-dotenv, flask, boto3, and pyyaml for Python, as well as axios, dotenv, and commander for Node.js. These are standard tools for API interaction and configuration management.\n- [INDIRECT_PROMPT_INJECTION]: The skill involves exploring the local codebase (ingestion point) to determine integration patterns. It possesses capabilities to write configuration files and make network calls to the LaunchDarkly API. However, it incorporates strong boundary markers by explicitly instructing the agent to prompt the user for API tokens instead of searching for them in local files. While explicit sanitization of ingested codebase content is not detailed, the restricted handling of secrets effectively mitigates the primary injection risk.\n- [SAFE]: Authored by the vendor 'launchdarkly', the skill's instructions and references are consistent with official documentation. All network operations target trusted vendor domains (e.g., launchdarkly.com), and the overall design promotes secure infrastructure-as-code and secret management practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 02:36 PM