·
Last changedVersion:
This version passed the hardening gate. Hardening applied 6 targeted changes and preserved all other text. Classified findings before hardening: 2. Classified findings closed: 2. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 4. Review findings remaining: 10.
2
None
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
references/sdk-track-patterns.md | Supply Chain & Install-Time Trust | Install-time download and execute | Low | Closed | |
references/sdk-track-patterns.md | Malicious Code & Command Execution | — | Low | Closed |
2 findings
You're using a skill that will guide you through adding a track() call to a codebase so a LaunchDarkly metric can measure it. Your job is to detect the SDK in use, find the right place in code to add the call, write it correctly, and verify that events are reaching LaunchDarkly.
This skill requires the remotely hosted LaunchDarkly MCP server to be configured in your environment.
Required MCP tools:
list-metric-events — verify events are flowing after instrumentationOptional MCP tools (enhance workflow):
get-project — retrieve the SDK key for the right environment when SDK initialization is neededBefore writing any code, understand the LaunchDarkly setup already in this codebase.
Search for existing track() calls. This is the fastest signal:
ldClient.track(, .track(, ld.track(Search for SDK imports and initialization if no track() calls exist:
package.json, requirements.txt, go.mod, Gemfile, *.csproj for an LD SDK dependencyLDClient, ldclient, launchdarkly-server-sdk, launchdarkly-node-server-sdk, launchdarkly-react-client-sdk, etc.Determine client-side or server-side. This is the most critical distinction — it determines the track() signature:
| SDK type | track() signature | Notes |
|---|---|---|
Server-side (Node, Python, Go, Java, Ruby, .NET) |
| Context required per call |
Client-side (React, browser JS) |
| Context set at init, not per call |
See SDK Track Patterns for full examples by language.
Skip this step if the SDK is already in the codebase.
Detect the package manager from lockfiles: package-lock.json / yarn.lock / pnpm-lock.yaml → npm/yarn/pnpm; Pipfile.lock / poetry.lock → pip/poetry; go.sum → go modules; Gemfile.lock → bundler.
Install the appropriate SDK using the detected package manager. See SDK Track Patterns for the right package name per language.
Get the SDK key using get-project — fetch the project and choose the key for the environment the user wants to instrument (typically staging for initial testing).
Add SDK initialization following the patterns already in this codebase. If there's a central config or service layer, add the LD client there. See SDK Track Patterns for initialization examples.
Locate where in the code the user action or event occurs.
Ask if you're not sure where the action happens. Don't guess at placement — a track() call in the wrong location (e.g. a render method instead of a submit handler) produces misleading data.
Look for signals of the right location:
segment.track(), mixpanel.track(), gtag()) — these are often co-located with where LD track calls should go// TODO: track thisShow the candidate location to the user before writing anything:
Proceed once confirmed.
track() CallWrite the call following the patterns found in Step 1.
Server-side SDKs — context is required:
Client-side SDKs — context is implicit:
For value metrics — include metricValue with the numeric measurement:
Key rules:
variation() calls) and use the same one. This is how LD correlates the event to the right experiment participant.metricValue only for value metrics. For count and occurrence metrics, omit metricValue entirely.featureFlags.track(), analytics.ldTrack()), add the new call through that wrapper — not by calling ldClient directly.track() event keys are case-sensitive. Use the exact string that the metric was created with.See SDK Track Patterns for full per-language examples.
Guide the user to trigger the action in their local or staging environment. Then use list-metric-events to confirm the event key appears:
If the event key appears: confirm success and show a summary.
If the event key is absent after triggering, work through this checklist:
| Problem | Check |
|---|---|
Wrong event key casing | Does the |
SDK not initialized | Is |
Server-side: wrong context | Is the context passed to |
Client-side: no flag evaluation first | Has the SDK initialized and identified the user before |
Wrong environment | Is |
Data delay |
|
Surface a summary once verified:
track() calls only count in experiments when a flag is evaluated first. The event is correlated to an experiment participant because LD saw a variation() call from that context. If the user triggers the action without evaluating any flag, the event may still be ingested but won't appear in experiment results.ldClient.flush() explicitly to see events appear immediately.ldClient.flush() after track() in development ensures the event is sent before the process exits or the test ends.metricValue units must match the metric definition. If the metric was created with unit ms, pass milliseconds. Passing seconds into a milliseconds metric will produce silently wrong results.data parameter is for custom metadata, not the metric value. Pass extra context (order ID, category, etc.) in data. Pass the numeric measurement in metricValue.track() call syntax, initialization, and package names for every supported SDKGet started with chainctlchainctl skill install public/launchdarkly/launchdarkly-metric-instrument:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/launchdarkly/skills/metrics/launchdarkly-metric-instrument:latest
Apache-2.0
HARDENING.md
LICENSE
SKILL.md
references/sdk-track-patterns.md