langsmith-fetch

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill instructs users/agents to export and explicitly echo the LANGSMITH_API_KEY (and similar env vars), which encourages printing or copying the API key value and thus risks exposing secrets verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow runs langsmith-fetch traces / langsmith-fetch trace <trace-id> to fetch “recent traces” and analyze execution/error messages from the user-configured LangSmith project, which can include outsider-authored prompt text contained in trace records.