projects
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill instructs the agent to automatically detect a LaunchDarkly API key by checking environment variables (
LAUNCHDARKLY_API_KEY,LAUNCHDARKLY_API_TOKEN,LD_API_KEY) and the Claude MCP configuration file at~/.claude/config.json. This access is context-appropriate as it targets the vendor's own configuration to streamline the setup of the vendor's services. - [PROMPT_INJECTION]: The 'Step 1: Explore the Codebase' workflow involves reading local files to understand the project's tech stack. This represents an indirect prompt injection surface; however, the skill provides no automated dangerous capabilities that could be exploited by malicious content within the analyzed codebase.
- [SAFE]: All code snippets provided in the
references/directory, including CLI tools, web dashboards, and CI/CD configurations, are instructional templates intended for user implementation and are not executed by the skill itself. - [SAFE]: The skill explicitly promotes security best practices, such as warning against committing API tokens to version control, recommending the use of environment-specific keys, and suggesting least-privilege access for tokens.
Audit Metadata