The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is vulnerable to shell command injection in Workflow 2. It accepts a trace ID from the user and interpolates it directly into a shell command (langsmith-fetch trace <trace-id>) without any validation or sanitization. An attacker can provide a malicious trace ID containing shell metacharacters (e.g., ;, &&, |) to execute arbitrary commands on the host system.
[COMMAND_EXECUTION]: The skill includes instructions to modify shell configuration files (~/.bashrc or ~/.zshrc) to persist environment variables. Modifying shell startup scripts is a persistence mechanism that ensures specific commands or configurations are executed in every future session, a technique often used to maintain unauthorized access.
[CREDENTIALS_UNSAFE]: The skill's instructions encourage the exposure of sensitive API keys. It provides commands to echo $LANGSMITH_API_KEY, which would print the secret key to the terminal or agent output logs, increasing the risk of credential leakage.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of the langsmith-fetch package via pip. While the documentation points to a well-known organization's repository, the package name and its actual source should be verified to prevent supply chain attacks such as typosquatting.
[DATA_EXFILTRATION]: The skill fetches and processes execution traces that contain sensitive agent data, including tool calls and memory content. It stores this information in local files and session folders, which could be exfiltrated if the environment is compromised or through the use of the skill's network-enabled tools.
[PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection as it ingests and analyzes untrusted execution traces from an external API.
Ingestion points: Trace data and JSON records fetched from the LangSmith Studio API via the langsmith-fetch tool (SKILL.md).
Boundary markers: None. The agent is instructed to perform deep analysis on the raw content of the traces without delimiters or instructions to ignore embedded malicious content.
Capability inventory: The skill has access to shell execution, package installation, and filesystem writes (SKILL.md).
Sanitization: There is no evidence of input validation or content filtering to prevent malicious instructions embedded within the fetched traces from influencing the agent's behavior.

langsmith-fetch