langchain
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves exclusively as a documentation and architectural guide for LangChain v1.3.15. All scripts are utility tools for version checking and documentation maintenance.
- [EXTERNAL_DOWNLOADS]: The skill provides standard installation commands for official LangChain packages (e.g.,
langchain,langchain-openai,langchain-anthropic) via PyPI. These are recognized industry-standard libraries. - [COMMAND_EXECUTION]: Includes a maintenance script
scripts/check-updates.pywhich performs local file integrity checks and fetches version information from the official PyPI JSON API (pypi.org). The script is restricted to reporting and does not execute arbitrary shell commands. - [DATA_EXPOSURE_AND_EXFILTRATION]: Documentation correctly illustrates best practices for secret management by using environment variables (e.g.,
export OPENAI_API_KEY="sk-..."). No sensitive data is hardcoded or exfiltrated. - [PROMPT_INJECTION]: No evidence of instructions intended to bypass AI safety filters or override system personas. The triggers are contextually appropriate for LangChain development tasks.
- [DYNAMIC_EXECUTION]: While LangChain itself supports complex agentic workflows, this skill's instructions and provided scripts do not utilize unsafe
eval(),exec(), or dynamic code loading from untrusted sources. Reference toeval()inreferences/05-tools.mdis a documented example of a calculator tool, not a functional part of the skill's own execution logic.
Audit Metadata