agent-statsig
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of the
agent-statsigCLI through theBashtool to manage feature gates, configurations, and experiments. - [CREDENTIALS_UNSAFE]: The documentation includes detailed instructions for handling Statsig Console and Client API keys. It correctly identifies the Console key as a high-sensitivity secret and provides specific remediation steps to avoid command-line argument leakage, such as using piped stdin or interactive forms.
- [DATA_EXFILTRATION]: While the skill manages sensitive configuration data, it does so within the intended scope of the Statsig service. The author provides clear warnings against practices that would expose credentials to context windows or logs.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API responses (Statsig rules, segments, and gates) which are then processed by the agent. The skill attempts to mitigate risks by instructing the agent to 'Inspect first' and validate criteria before applying changes.
Audit Metadata