·
Last changedVersion:
This version passed the hardening gate. Hardening applied 7 targeted changes and preserved all other text. Classified findings before hardening: 2. Classified findings closed: 1. Classified findings remaining: 1. Unclassified scanner findings remaining: 0. Review findings closed: 9. Review findings remaining: 4.
2
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Memory & Context Poisoning | — | Medium | Open | |
SKILL.md | Sensitive Data & Secret Exposure | Data exfiltration | Medium | Closed |
2 findings
You're using a skill that will guide you through creating a config in LaunchDarkly. Your job is to understand the use case, choose the right mode, create the config and its variations, and verify everything is set up correctly.
This skill requires the remotely hosted LaunchDarkly MCP server to be configured in your environment.
Primary MCP tool:
setup-ai-config -- create a config with its first variation in one step (recommended)Alternative MCP tools (for more control):
create-ai-config -- create just the config shell (key, name, mode)create-ai-config-variation -- add a variation with model, prompts, and parametersget-ai-config -- verify the config was created correctlyOptional MCP tools (enhance workflow):
list-ai-configs -- browse existing configs to understand naming conventionsUse reasonable defaults for unspecified fields: default for variation key, the use case as the basis for instructions/messages, kebab-case for config keys.
Before creating, identify what you're building:
This choice is about input schema and framework compatibility, not execution behavior. Agent mode returns an instructions string; completion mode returns a messages array. Both provide provider abstraction, A/B testing, and metrics tracking.
| Your Need | Mode | Why |
|---|---|---|
LangGraph, CrewAI, Strands, AutoGen frameworks | Agent | Frameworks expect goal/instruction input |
Persistent instructions across interactions | Agent | Single instructions string, SDK method: |
Direct OpenAI/Anthropic API calls | Completion | Messages array maps directly to provider APIs |
Full control of message structure | Completion | System/user/assistant role-based messages |
One-off text generation | Completion | Standard chat format |
Need online evaluations (LLM-as-judge) | Completion | Online evals are only available in completion mode |
Both modes support tools. Not all models support agent mode -- check model compatibility if using agent mode. If unsure, start with completion mode (it's the API default and more flexible).
Use setup-ai-config to create the config and its first variation in one call. This is the recommended approach: it handles creation, variation setup, and verification automatically.
Config fields:
key -- unique identifier (lowercase, hyphens)name -- human-readable namemode -- "agent" or "completion"description, tagsVariation fields:
variationKey, variationName -- identifiers for the first variationmodelConfigKey -- must be Provider.model-id format (e.g., OpenAI.gpt-4o, Anthropic.claude-sonnet-4-5)modelName -- the model identifier (e.g., gpt-4o). Always pass this in the initial call — leaving it off produces a variation that displays "NO MODEL" and forces a second PATCH to set it. The field is modelName; it is not name or model.name on this endpoint.For agent mode, provide:
instructions -- a string with the agent's system instructionsExample agent-mode call:
For completion mode, provide:
messages -- an array of {role, content} objects (system, user, assistant)Example completion-mode call:
Optional:
parameters -- model parameters like {temperature: 0.7, max_tokens: 2000} (match the UI's snake_case keys)The tool returns the full verified config detail with the variation attached.
If the user asks for more control or a step-by-step approach, use the individual tools:
create-ai-config -- create the config shellcreate-ai-config-variation -- add the variation with model, prompts, and parametersget-ai-config -- verify the resultInfer the variation key (default), name (Default), instructions/messages, and model from the user's request context. If the user asked for GPT-4o agent mode, you have enough to complete the entire flow. Only ask clarifying questions if the mode or model is truly ambiguous.
If you used setup-ai-config, verification is automatic: the response includes the full config with variations. Check:
Use get-ai-config for the verification call — do not drop to raw curl + jq. The MCP tool returns a typed object you can inspect directly. Hand-rolled jq filters against the REST response routinely break: the configs detail endpoint returns the variation list under different keys depending on expand, and a filter like .variations.items[] will fail with Cannot index array with string "items" when the response shape is a bare array. If you must call the REST API, use jq -e . first to inspect the actual shape before drilling in.
Report results:
https://app.launchdarkly.com/projects/{projectKey}/ai-configs/{configKey}setup-ai-config and create-ai-config-variation create the variation but do not promote it to fallthrough. The new config will return enabled=False to every consumer until targeting is updated. This is the single most common "I created a config but my SDK still gets the fallback" failure. The workflow is not complete until this step is done.
Print this checklist verbatim to the user after Step 4, then wait for confirmation. Do not claim the skill succeeded until the user confirms the fallthrough was flipped.
Required for models to display in the UI. Format: {Provider}.{model-id}
OpenAI.gpt-4oOpenAI.gpt-4o-miniAnthropic.claude-sonnet-4-5Anthropic.claude-3-5-sonnetThe create-ai-config-variation tool validates this format and rejects invalid values.
| Situation | Action |
|---|---|
Config already exists | Ask if user wants to update instead |
Variation shows "NO MODEL" | Use |
Need to attach tools | Create tools first ( |
modelName from the initial variation call. It is required at create time; setting it via a follow-up PATCH is a workaround for a bug, not the intended flow. The PATCH field is also modelName, not name.curl + jq for verification. Use get-ai-config (MCP) — it returns a typed object and avoids brittle jq filters that break on response-shape variation.configs-targeting. A created variation that isn't promoted to fallthrough returns enabled=False to every consumer.To learn more about creating a config in the LaunchDarkly UI, read Create configs
To learn more about configuring the SDK, read:
tools -- Create tools before attachingconfigs-variations -- Add more variations for experimentationconfigs-update -- Modify configs based on learningsGet started with chainctlchainctl skill install public/launchdarkly/configs-create:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/launchdarkly/skills/agentcontrol/configs-create:latest
Apache-2.0
HARDENING.md
LICENSE
README.md
SKILL.md