The skill exposes hardcoded credentials, executes unpinned packages, and performs unauthorized network and file operations without declaring necessary tool constraints, creating significant security and supply chain risks.
Skill Info
Install
npx skills add https://github.com/launchdarkly/agent-skillsAssessments (3)
AI Agent Traps ↗Hardcoded credentials detected. Passwords, API keys, and secrets should not be hardcoded in source code. Use environment variables or a secrets manager instead.
key: 'demo-user'
Hardcoded credentials detected. Passwords, API keys, and secrets should not be hardcoded in source code. Use environment variables or a secrets manager instead.
key: 'example-user-key'
Unpinned npx package execution — `npx <pkg>` without a version pin pulls latest from npm at runtime (seen 2 times in this file at lines 17, 353)
npx skills
Badge
[](https://mondoo.com/ai-agent-security/skills/github/launchdarkly/agent-skills/first-flag)<a href="https://mondoo.com/ai-agent-security/skills/github/launchdarkly/agent-skills/first-flag"><img src="https://mondoo.com/ai-agent-security/api/badge/github/launchdarkly/agent-skills/first-flag.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/launchdarkly/agent-skills/first-flag.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow