Feature Flag Cleanup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:09 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for feature-flag cleanup, but it gives agents broad destructive cleanup guidance without clear confirmation gates.

Install only if you want an agent to help plan and generate feature-flag removals. Use it with narrow project/environment scope, require dry-run inventories first, review exact flag IDs and affected environments, and approve every PR, migration, archive, hard-delete, cron, or memory update manually.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The LaunchDarkly DELETE endpoint is presented as a normal workflow step, creating a tool-parameter abuse risk where an agent may construct destructive API calls from loosely validated project and flag identifiers. In context, the skill's purpose is cleanup and decommissioning, so the path from analysis to deletion is short, making accidental or over-broad mutation more plausible.

Content

Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.

md

**LaunchDarkly:**

- API: `DELETE /api/v2/flags/{projKey}/{flagKey}` (archives by default; pass `?archived=true` to unarchive)
- Use **flag tags** liberally — `temporary`, `experiment`, `kill-switch` make Step 2 automatic going forward
- LD's **Code references** integration (via GitHub/GitLab) is the single highest-leverage tool — install before doing the audit
- LD bills per **MAU evaluated**, not per flag — removing a low-traffic flag saves nothing on the bill; removing a high-traffic experiment that's still 50/50 on a logged-in segment saves the most

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

The hard-delete archive endpoint is especially risky because it can permanently remove previously archived flags, reducing recovery options and forensic visibility. In a cleanup skill, exposing this operation inline without strict safeguards encourages irreversible actions before sufficient monitoring, retention, or rollback windows have elapsed.

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

md

- Open-source, often self-hosted; cleanup recovers DB rows but not license cost
- Built-in **stale flag** UI under Project → Reports
- API: `DELETE /api/admin/features/{name}` (archives), then `DELETE /api/admin/archive/{name}` (hard delete)
- Strategies are independent objects — verify no other flag references the strategy before deleting it
- Unleash 5+ supports **Dependencies** between flags — break dependencies before deletion

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

The hard-delete archive endpoint is especially risky because it can permanently remove previously archived flags, reducing recovery options and forensic visibility. In a cleanup skill, exposing this operation inline without strict safeguards encourages irreversible actions before sufficient monitoring, retention, or rollback windows have elapsed.

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

md

- Open-source, often self-hosted; cleanup recovers DB rows but not license cost
- Built-in **stale flag** UI under Project → Reports
- API: `DELETE /api/admin/features/{name}` (archives), then `DELETE /api/admin/archive/{name}` (hard delete)
- Strategies are independent objects — verify no other flag references the strategy before deleting it
- Unleash 5+ supports **Dependencies** between flags — break dependencies before deletion

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The Flagsmith DELETE endpoint is a direct destructive primitive, and the skill discusses sweeping orphaned segments in the same area, increasing the chance of broad cleanup actions built from imperfect joins or stale telemetry. If an agent misidentifies a feature as stale, deletion can remove production controls across environments.

Content

Scanner excerpt · SKILL.md (reported line 258)May include surrounding context.

md

**Flagsmith:**

- Per-environment overrides are common — verify all environments have collapsed to a single value before removal
- API: `DELETE /api/v1/projects/{id}/features/{id}/`
- **Segments** are project-scoped; orphaned segments accumulate fast — sweep them in the same audit
- Self-hosted Flagsmith persists evaluation logs only if the influxdb integration is enabled — without it, R3 (last_evaluation) is unreliable

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

The GrowthBook DELETE endpoint is documented as part of routine cleanup, despite requiring admin privileges and potentially affecting experiment-linked features. In this context, an agent could over-trust inferred staleness and generate privileged destructive actions that remove feature definitions still needed for analysis, rollback, or active routing.

Content

Scanner excerpt · SKILL.md (reported line 266)May include surrounding context.

md

- Experiment-first model; many flags are tied to a running experiment doc
- Closing the experiment doesn't delete the flag — explicitly archive after analysis
- API: `DELETE /api/v1/features/{id}` (requires admin role)
- The **Code references** scan in the GrowthBook proxy is opt-in; turn it on before audit

**Split.io:**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The Split.io DELETE endpoint is especially dangerous because the skill itself notes workspace sensitivity and ease of deleting the wrong environment. That explicit warning confirms the operation's sharp edge, and without parameter validation or confirmation barriers an agent could target the wrong workspace or split and remove active production configuration.

Content

Scanner excerpt · SKILL.md (reported line 273)May include surrounding context.

md

- "Splits" are the flag; "Treatments" are the variants
- Killing a split via UI sets it to a single treatment but does not remove from code — agent must still produce the code-removal PR
- API: `DELETE /internal/api/v2/splits/ws/{wsId}/{splitName}` (workspaces matter, easy to delete the wrong env)
- Split's **dynamic configurations** are JSON-typed — removal recipes for these inline the JSON value, not a boolean

**Custom / DB-backed flags:**

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs deletion of service definitions, dead branches, tests, modules, and even database rows, but does not present a prominent user-facing warning or mandatory confirmation gate before destructive actions. In an agent setting, this increases the chance that a user invokes the skill for 'audit' purposes and the agent proceeds into removal planning or execution that can cause data loss, broken rollbacks, or production regressions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The provider-specific section documents direct DELETE endpoints across multiple flag platforms, including hard-delete flows, without a strong warning that these are destructive and environment-sensitive operations. Because the skill is designed to generate scripts and PRs, this materially raises the risk that an agent could issue or recommend irreversible deletion against the wrong project, workspace, or environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.