·
Last changedVersion:
This version passed the hardening gate. Hardening applied 25 targeted changes and preserved all other text. Classified findings before hardening: 3. Classified findings closed: 3. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 16. Review findings remaining: 0.
3
None
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
references/safety-checklist.md | Excessive Agency & Rogue Autonomy | — | Medium | Closed | |
references/approval-workflows.md | Excessive Agency & Rogue Autonomy | — | Medium | Closed | |
SKILL.md | Excessive Agency & Rogue Autonomy | — | Medium | Closed |
3 findings
You're using a skill that will guide you through changing who sees what for a feature flag. Your job is to understand the current state of the flag, figure out the right targeting approach for what the user wants, make the changes safely, and verify the resulting state.
This skill requires the remotely hosted LaunchDarkly MCP server to be configured in your environment. Configure that connection with the least access the task needs, limited to the required projects and environments, and route production changes through approvals where available.
Required MCP tools:
get-flag: understand current state before making changestoggle-flag: turn targeting on or off for a flag in an environmentupdate-rollout: change the default rule (fallthrough) variation or percentage rolloutupdate-targeting-rules: add, remove, or modify custom targeting rulesupdate-individual-targets: add or remove specific users/contexts from individual targetingOptional MCP tools:
copy-flag-config: copy targeting configuration from one environment to anothercreate-approval-request: create an approval request when direct changes are blockedlist-approval-requests: check on pending approval requests for a flagapply-approval-request: apply an already-approved approval requestBefore making any targeting changes, understand how LaunchDarkly evaluates flags. This determines what your changes actually do:
offVariation to everyone. Nothing else matters.This means: if you add a targeting rule but the flag is OFF, nobody sees the change. If you set a percentage rollout on the default rule but there's an individual target, that targeted user bypasses the rollout.
Before changing anything, check what's already configured.
get-flag with the target environment to see:
on: Is targeting currently enabled?fallthrough: What's the default rule? (variation or percentage rollout)offVariation: What serves when the flag is off?rules: Any custom targeting rules?targets: Any individually targeted users/contexts?prerequisites: Any flags this depends on?Based on what the user wants and what you found, choose the right tool and strategy. See Targeting Patterns for the full reference.
Common scenarios:
| User wants | Tool | Notes |
|---|---|---|
"Turn it on" |
| Simplest change |
"Turn it off" |
| Serves offVariation to everyone |
"Roll out to X%" |
| Weights must sum to 100 |
"Enable for beta users" |
| Rules are ANDed within, ORed between |
"Add specific users" |
| Highest priority, overrides all rules |
"Full rollout" |
| Serve one variation to everyone |
"Copy from staging" |
| Promote tested config to production |
Before writing a rule, individual target, or percentage rollout, confirm the context supports it. A rule that names a context kind or attribute the flag's evaluation doesn't carry silently never matches; individual targets match the context key, not an attribute like email; and a rollout can only bucket by a kind present where the flag is read. See Context Availability to pick a context that will actually fire.
Before applying changes, especially in production, run through the Safety Checklist. The key checks:
requiresApproval: true:
approvalUrl if provided.create-approval-request with the same instructions (returned in the instructions field of the response).Confirm with the user first. Before calling toggle-flag, update-rollout, update-targeting-rules, update-individual-targets, copy-flag-config, or apply-approval-request, summarize the flag key, the environment, the current and resulting state from get-flag, and the audit comment, then wait for an explicit yes from the user. This step is mandatory for production.
Use the appropriate tool for the change. Key notes:
toggle-flag: Specify on: true or on: false, the env, and a comment.update-rollout: Use rolloutType: "percentage" with human-friendly weights (e.g., 80 for 80%) that sum to 100, or rolloutType: "variation" with a variationIndex.update-targeting-rules: Instructions support addRule, removeRule, updateRuleVariationOrRollout, addClauses, removeClauses, reorderRules.update-individual-targets: Instructions support addTargets, removeTargets, addContextTargets, removeContextTargets, replaceTargets.copy-flag-config, replaceTargets, and removeRule overwrite or discard existing configuration. Before using them, fetch the current state with get-flag (source and destination for copies), record it, show the user which rules and targets will be added or removed, and get explicit confirmation. Prefer addTargets and removeTargets over replaceTargets.See Targeting Patterns for detailed instruction examples.
After applying changes, confirm the result:
get-flag again to verify the new state.true to 25% of users and false to 75%."When any mutation tool returns requiresApproval: true, the direct change was blocked because the environment requires approvals. Follow the Approval Workflows reference to:
create-approval-request using the instructions from the blocked responselist-approval-requests if requestedapply-approval-request only when the user explicitly asks to apply one specific request. First check again with list-approval-requests that reviewStatus is "approved", show the request ID, flag, environment, and instructions, confirm they match the originally requested change, and fetch the flag again with get-flag to warn the user if its state changedget-flag after applyingupdate-rollout uses human-friendly percentages. Pass 80 for 80%, not 80000. The tool handles the internal weight conversion.Get started with chainctlchainctl skill install public/launchdarkly/launchdarkly-flag-targeting:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/launchdarkly/skills/feature-flags/launchdarkly-flag-targeting:latest
Apache-2.0
HARDENING.md
LICENSE
README.md
SKILL.md
marketplace.json
references/approval-workflows.md
references/context-availability.md
references/safety-checklist.md
references/targeting-patterns.md