projects
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several well-known libraries in its implementation guides, including
requests,python-dotenv,flask,boto3, andpyyamlfor Python, as well asaxios,dotenv, andcommanderfor Node.js. These are standard tools for API interaction and configuration management.\n- [INDIRECT_PROMPT_INJECTION]: The skill involves exploring the local codebase (ingestion point) to determine integration patterns. It possesses capabilities to write configuration files and make network calls to the LaunchDarkly API. However, it incorporates strong boundary markers by explicitly instructing the agent to prompt the user for API tokens instead of searching for them in local files. While explicit sanitization of ingested codebase content is not detailed, the restricted handling of secrets effectively mitigates the primary injection risk.\n- [SAFE]: Authored by the vendor 'launchdarkly', the skill's instructions and references are consistent with official documentation. All network operations target trusted vendor domains (e.g., launchdarkly.com), and the overall design promotes secure infrastructure-as-code and secret management practices.
Audit Metadata