flags-sdk
Pass
Audited by Gen Agent Trust Hub on Nov 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- External Resource Installation: The skill facilitates the installation of npm packages such as
flagsand various@flags-sdk/*adapters. These packages are essential for feature flag management within the Next.js and SvelteKit ecosystems. - Environment Variable Management: It uses the Vercel CLI to synchronize environment variables (e.g.,
VERCEL_OIDC_TOKEN) to local development environments. This is a standard practice for maintaining local and remote environment parity. - Sensitive Credential Handling: The instructions include best practices for generating and storing
FLAGS_SECRET, specifically advising against printing secrets to terminal output or logs and suggesting direct piping to storage tools. - CLI-Based Project Integration: The skill automates tasks like project linking (
vercel link) and flag creation (vercel flags create). These actions require the user to have an authenticated Vercel CLI session and represent standard project management operations. - Remote Configuration Ingestion: Flag definitions are read from Vercel's remote configuration to generate matching TypeScript code. This ensures that local code definitions remain in sync with the feature flag provider's dashboard settings.
- Metadata Exposure Protection: The skill describes how to set up a flags discovery endpoint and emphasizes the use of verification functions to ensure that only authorized requests can access flag metadata.
Audit Metadata