feature-flags
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the official
posthog-nodepackage from the NPM registry to enable server-side feature flag evaluation via a well-known service. - [COMMAND_EXECUTION]: Employs standard shell commands such as
grepandcatto verify existing project configuration and usesnpmfor dependency management. - [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing feature flag keys and user identifiers (
distinctId) to control application logic. - Ingestion points: User IDs and flag keys are passed to
isFeatureEnabledandgetFeatureFlagVariantfunctions inlib/posthog-server.ts. - Boundary markers: None present; the skill assumes valid identifiers are provided by the application's authentication layer.
- Capability inventory: Performs network requests via the PostHog Node.js SDK.
- Sanitization: Flag keys are converted to uppercase and formatted to match environment variable patterns for local overrides.
Audit Metadata