finding-deleted-feature-flags
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script
scripts/strip_deleted_suffix.py. The script is designed for simple JSON processing and string manipulation to restore feature flag keys to their original format. This is a standard utility function and does not perform any dangerous system operations or network requests. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from feature flag activity logs and SQL results. While this data is technically untrusted, the skill's logic is restricted to retrieving and displaying information in a table format. There are no capabilities (like code execution or file writing) that could be maliciously triggered by the content of the feature flags.
- [SAFE]: The skill uses established PostHog tools (
posthog:execute-sqlandposthog:feature-flags-activity-retrieve) and follows best practices for secret management by assuming a pre-authenticated environment. No credentials, sensitive file access, or unauthorized network activity were detected.
Audit Metadata