custom-metrics

Environment secret flows to a network sink (exfiltration)

taint source (line 16): os.environ.get("LAUNCHDARKLY_API_TOKEN") → sink: requests.post(url, json=payload, headers=headers)

Environment secret flows to a network sink (exfiltration)

taint source (line 9): os.environ.get("LAUNCHDARKLY_API_TOKEN") → sink: requests.patch(url, json=updates, headers=headers)

The skill explicitly instructs the agent to read `~/.claude/config.json` to extract API keys, which is an unauthorized access pattern to sensitive local configuration files.

claude_config = Path.home() / ".claude" / "config.json"

The skill automatically scrapes multiple environment variables for API tokens, increasing the risk of accidental exposure if the agent is running in a compromised or shared environment. [severity raised to high: this vector is independently flagged by both deterministic and LLM analysis (ADR-0065 corroboration).]

for var in ["LAUNCHDARKLY_API_KEY", "LAUNCHDARKLY_API_TOKEN", "LD_API_KEY"]:

Outbound network request primitive in skill code — can transmit data externally

requests.post(url, json=payload, headers=headers)

Outbound network request primitive in skill code — can transmit data externally

requests.get(url, headers=headers)

Skill executes commands, writes files, or accesses the network but declares no allowed-tools, so its tool surface cannot be reviewed or constrained.