statsig
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install or update the
@replohq/sdkpackage from the npm registry to ensure compatibility with Statsig integration features. This is a vendor-owned resource managed by the skill's author. - [COMMAND_EXECUTION]: The skill uses a diagnostic CLI command
node -eto verify the exported members of the@replohq/sdkpackage, ensuring the environment supports the required cookie-handling functions before proceeding with code generation. - [INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow for collecting configuration parameters from the user, such as ID types and cookie names, which are subsequently interpolated into generated Next.js middleware and component code.
- Ingestion points: User-supplied configuration values for Statsig experiments (e.g., ID Type, Cookie Name, Domain).
- Boundary markers: Absent; the skill relies on direct interpolation of user inputs into code templates.
- Capability inventory: The skill generates file writes for middleware and application pages and executes diagnostic CLI commands.
- Sanitization: No explicit sanitization or validation of the user-provided configuration strings is performed within the instructions.
- [DYNAMIC_EXECUTION]: The skill utilizes
node -eto dynamically evaluate the contents of the local vendor SDK for feature detection during the setup process.
Audit Metadata