flags-sdk
Pass
Audited by Gen Agent Trust Hub on Apr 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- Package Installations: The skill instructs the agent to install various Node.js packages like
flags,@flags-sdk/vercel, and@vercel/toolbar. These are official vendor-maintained libraries required for feature flag functionality and development tools. - CLI Tooling: It involves executing
vercel flagsandvercel envcommands. These actions are used to register flags with the Vercel platform and pull necessary configuration (like encryption secrets) into the local environment, which is part of the intended setup process. - Supplemental Skill Integration: The instructions mention adding a related skill (
vercel-cli) from a trusted vendor repository. This allows the agent to utilize specialized CLI knowledge to complete complex setup tasks. - Data Privacy and Security: The SDK provides built-in functions for encrypting flag data and definitions, as well as an XSS-safe JSON stringification utility. These features are designed to help developers handle feature flag metadata securely.
- Dynamic Code Generation: The guide mentions using
npx hypertunefor code generation. This is a common pattern for type-safe SDKs to synchronize remote configurations with local types.
Audit Metadata