skills/replohq/skills/statsig/Gen Agent Trust Hub

statsig

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install or update the @replohq/sdk package from the npm registry to ensure compatibility with Statsig integration features. This is a vendor-owned resource managed by the skill's author.
  • [COMMAND_EXECUTION]: The skill uses a diagnostic CLI command node -e to verify the exported members of the @replohq/sdk package, ensuring the environment supports the required cookie-handling functions before proceeding with code generation.
  • [INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow for collecting configuration parameters from the user, such as ID types and cookie names, which are subsequently interpolated into generated Next.js middleware and component code.
  • Ingestion points: User-supplied configuration values for Statsig experiments (e.g., ID Type, Cookie Name, Domain).
  • Boundary markers: Absent; the skill relies on direct interpolation of user inputs into code templates.
  • Capability inventory: The skill generates file writes for middleware and application pages and executes diagnostic CLI commands.
  • Sanitization: No explicit sanitization or validation of the user-provided configuration strings is performed within the instructions.
  • [DYNAMIC_EXECUTION]: The skill utilizes node -e to dynamically evaluate the contents of the local vendor SDK for feature detection during the setup process.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 05:48 PM