skills/vercel/flags/flags-sdk/Gen Agent Trust Hub

flags-sdk

Pass

Audited by Gen Agent Trust Hub on Nov 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • External Resource Installation: The skill facilitates the installation of npm packages such as flags and various @flags-sdk/* adapters. These packages are essential for feature flag management within the Next.js and SvelteKit ecosystems.
  • Environment Variable Management: It uses the Vercel CLI to synchronize environment variables (e.g., VERCEL_OIDC_TOKEN) to local development environments. This is a standard practice for maintaining local and remote environment parity.
  • Sensitive Credential Handling: The instructions include best practices for generating and storing FLAGS_SECRET, specifically advising against printing secrets to terminal output or logs and suggesting direct piping to storage tools.
  • CLI-Based Project Integration: The skill automates tasks like project linking (vercel link) and flag creation (vercel flags create). These actions require the user to have an authenticated Vercel CLI session and represent standard project management operations.
  • Remote Configuration Ingestion: Flag definitions are read from Vercel's remote configuration to generate matching TypeScript code. This ensures that local code definitions remain in sync with the feature flag provider's dashboard settings.
  • Metadata Exposure Protection: The skill describes how to set up a flags discovery endpoint and emphasizes the use of verification functions to ensure that only authorized requests can access flag metadata.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 14, 2026, 01:49 AM