configcat
Fail
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: HIGHCREDENTIALS_UNSAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The .env file contains hardcoded authentication credentials for the ConfigCat Management API.
- Evidence: The configuration file includes explicit values for CONFIGCAT_BASIC_AUTH_USERNAME, CONFIGCAT_BASIC_AUTH_PASSWORD, and CONFIGCAT_AUTHORIZATION_HEADER which appear to be active credentials rather than placeholders.
- [COMMAND_EXECUTION]: The skill executes multiple local bash scripts to perform its core functions, which increases the agent's local execution surface.
- Evidence: SKILL.md routes user commands to scripts/configcat_flag.sh using $ARGUMENTS.
- [PROMPT_INJECTION]: The skill ingests data from external API responses which could potentially contain malicious instructions, creating a surface for indirect prompt injection.
- Ingestion points: The api_request function in scripts/common.sh fetches data from api.configcat.com (e.g., product lists, flag settings).
- Boundary markers: No explicit delimiters or instructions are used to warn the agent about potential instructions within the fetched API data.
- Capability inventory: The skill has access to shell script execution (bash), file system writing (mktemp, jq redirects), and network operations (curl).
- Sanitization: Data is parsed using jq, which validates JSON structure but does not filter out natural language instructions that could influence the agent's behavior.
Recommendations
- AI detected serious security threats
Audit Metadata