plan
github.com/launchdarkly/agent-skills
Scanned Thu, 28 May 2026 17:21:52 GMT
Scan ID crawl-mj8pb3zlr6uewviky9zgr57d · 1ms
A
SCORE 95 / 100
Verdict: Safe to install
2 medium findings.
This skill ships without a capability manifest plus 1 other issue listed below.
0 critical0 high2 medium10 rules passed
Why grade A?
score · 95 / 100The current grade reflects 2 minor findings below all thresholds.
0 CRIT0 HIGH2 MED0 LOW
Already at the top grade — no further rules to pass.
Findings · ordered by severity
medNo capability manifest declaredThe skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.rule: no-manifest▾
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule:
no-manifestmedLink text shows "node.js" but points at launchdarkly.comThe visible link text contains the domain `node.js`, but the URL actually targets `launchdarkly.com`. This is a phishing/smuggling pattern — the reader sees one host, the agent fetches another. Either update the text or the URL so they match.▾
Link text shows "node.js" but points at launchdarkly.com
The visible link text contains the domain `node.js`, but the URL actually targets `launchdarkly.com`. This is a phishing/smuggling pattern — the reader sees one host, the agent fetches another. Either update the text or the URL so they match.
73
74- **Next.js**: Server-side SDK for API routes / server components / RSC contexts that evaluate on the server; React client SDK for client components. If the user requested **both**, the plan lists **both** tracks in full. If they only want one surface to start, state that explicitly in the plan.
75- **Node.js**: If it's a backend service (Express, Fastify, etc.), use the server-side SDK. There is also a [Node.js client SDK](https://launchdarkly.com/docs/sdk/client-side/node-js) for desktop/Electron apps.← text→node.js · href→launchdarkly.com
76- **React**: If it's a standalone SPA, use `launchdarkly-react-client-sdk`. If it's part of Next.js, see above.
77- **.NET**: Use the **server** SDK (`LaunchDarkly.ServerSdk`) for ASP.NET and backend services. For MAUI, Xamarin, WPF, and UWP, use the **.NET mobile SDK** (`LaunchDarkly.ClientSdk`, **mobile key**) -- [SDK recipes -- .NET (Client)](../../references/sdk/recipes.md#net-client). **Blazor WebAssembly** (and other browser-hosted .NET client UI) still uses `LaunchDarkly.ClientSdk` but with a **client-side ID**, not a mobile key -- see the same recipe.
skillox.io/r/crawl-mj8pb3zlr6uewviky9zgr57d