feature-flags

Pass

Audited by Gen Agent Trust Hub on Jul 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the official posthog-node package from the NPM registry to enable server-side feature flag evaluation via a well-known service.
  • [COMMAND_EXECUTION]: Employs standard shell commands such as grep and cat to verify existing project configuration and uses npm for dependency management.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing feature flag keys and user identifiers (distinctId) to control application logic.
  • Ingestion points: User IDs and flag keys are passed to isFeatureEnabled and getFeatureFlagVariant functions in lib/posthog-server.ts.
  • Boundary markers: None present; the skill assumes valid identifiers are provided by the application's authentication layer.
  • Capability inventory: Performs network requests via the PostHog Node.js SDK.
  • Sanitization: Flag keys are converted to uppercase and formatted to match environment variable patterns for local overrides.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 27, 2026, 08:48 AM
Security Audit — agent-trust-hub — feature-flags