langfuse

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs embedding API keys (pk-..., sk-...) directly into CLI commands/--env flags, which requires the agent to output secret values verbatim and thus poses an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow uses Langfuse MCP tools like fetch_trace(..., include_observations=true) / fetch_observation(...) / find_exceptions_in_file(...) to retrieve trace/observation/exception text from the Langfuse backend at runtime, which can include outsider-authored free-form content (e.g., user messages or other participants’ inputs) and is then ingested into the agent’s LLM context via the tool responses.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill sets LANGFUSE_HOST to https://cloud.langfuse.com and at runtime the MCP tools (e.g., get_prompt/get_prompt_unresolved) fetch prompt content from that host which can directly control agent instructions, so this external URL is a required runtime dependency that influences prompts.