arize-migrate-langfuse
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of a bundled migration script (
scripts/migrate_vendor_traces.py) to automate data export and ingestion. This script is intended to be run by the user or agent to process observability data between platforms. - [EXTERNAL_DOWNLOADS]: The migration process involves fetching data from external Langfuse API endpoints (
LANGFUSE_BASE_URL). These requests are performed using authenticated standard libraries to retrieve historical observations, datasets, and prompts. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes historical trace content and observation data from Langfuse. While this presents an ingestion surface, the instructions explicitly command the agent to treat this content as raw data only and include verification steps that involve sampling the migrated data.
- [CREDENTIALS_SAFE]: The skill demonstrates strong security practices for credential management. It strictly prohibits reading
.envfiles from disk, instructs the agent to never ask for keys in chat, and mandates the use of environment variables (ARIZE_API_KEY,LANGFUSE_SECRET_KEY, etc.) and the vendor's official CLI profiles for authentication.
Audit Metadata