traffical
Traffical enables feature flags, A/B testing, and adaptive optimization for gradual rollouts and experimentation to enhance conversions.
Install this skill
Security score
The traffical skill was audited on Feb 27, 2026 and we found 19 security issues across 3 threat categories, including 2 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Access to hidden dotfiles in home directory
| 86 | > **Important:** The `--api-key` flag requires a real Management Key or Full Access key. **Never fabricate or guess API keys.** If no key is available in environment variables (`TRAFFICAL_API_KEY`) or |
Access to hidden dotfiles in home directory
| 100 | | `--api-key <key>` | Management or Full Access key (falls back to `TRAFFICAL_API_KEY` env var or `~/.trafficalrc`) | |
Access to hidden dotfiles in home directory
| 161 | 1. You provide a **Management Key** (or Full Access key) via `--api-key` or `~/.trafficalrc` |
Access to hidden dotfiles in home directory
| 167 | - The **Management Key** stays in `~/.trafficalrc` (for CLI operations like push/pull/sync) |
Access to .env file
| 113 | ├── .env # TRAFFICAL_API_KEY=... (gitignored, auto-generated SDK key) |
Access to .env file
| 114 | ├── .gitignore # Ensures .env is never committed |
Access to .env file
| 121 | **After init**, add `TRAFFICAL_API_KEY` from `.traffical/.env` to your project's `.env` or hosting environment for runtime SDK use. The auto-generated key has `sdk:read` and `sdk:write` scopes — just |
Access to .env file
| 163 | 3. The CLI **auto-creates a project-scoped SDK key** via the API and saves it to `.traffical/.env` |
Access to .env file
| 164 | 4. The `.traffical/.gitignore` is created/updated to ensure `.env` is never committed |
Access to .env file
| 168 | - The **SDK Key** goes into `.traffical/.env` (for runtime use in your app) |
Access to .env file
| 176 | .traffical/.env |
Access to .env file
| 180 | Copy this value to your project's `.env` or hosting environment variables for your SDK to use at runtime. |
Access to .env file
| 184 | After `traffical init`, the `.traffical/config.yaml` contains `project.id` and `project.orgId`. Use these values (along with an `env` like `"production"`) when initializing the SDK. The SDK key is in |
Access to .env file
| 307 | apiKey: process.env.TRAFFICAL_API_KEY!, // from .traffical/.env |
Access to .env file
| 334 | apiKey: process.env.TRAFFICAL_API_KEY!, |
Prompting for API key/token input
| 56 | 1. **Initialize** — Run `npx @traffical/cli init --api-key <management-key> --framework <name> --yes` to set up the project non-interactively (or check for an existing `.traffical/` directory). The us |
Prompting for API key/token input
| 86 | > **Important:** The `--api-key` flag requires a real Management Key or Full Access key. **Never fabricate or guess API keys.** If no key is available in environment variables (`TRAFFICAL_API_KEY`) or |
External URL reference
| 86 | > **Important:** The `--api-key` flag requires a real Management Key or Full Access key. **Never fabricate or guess API keys.** If no key is available in environment variables (`TRAFFICAL_API_KEY`) or |
External URL reference
| 507 | - **Dashboard**: https://app.traffical.io |