skills/openai/plugins/vercel-flags/Gen Agent Trust Hub

vercel-flags

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFE
Full Analysis
  • [Secure Configuration Guidance]: The skill provides clear instructions on managing sensitive environment variables such as FLAGS_SECRET and FLAGS. It correctly recommends using base64-encoded random bytes for secrets, which aligns with standard security practices for encryption and authentication.
  • [Trusted Dependency Management]: The instructions and code examples reference official packages and domains from Vercel (e.g., @vercel/flags, flags-sdk.dev). These are well-known and established services, and the use of these dependencies is consistent with the skill's primary purpose.
  • [Data Ingestion Patterns]: The skill demonstrates the use of the identify function to pass user and team context to flag evaluation logic. This is a standard architectural pattern for feature flags and does not introduce unusual data exposure risks within the described context.
  • [Discovery Endpoint Security]: The implementation of the Flags Discovery Endpoint includes a verification step (verifyAccess), demonstrating an awareness of the need to protect metadata endpoints from unauthorized access.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 03:19 PM
Security Audit — agent-trust-hub — vercel-flags