langfuse-laravel-ai
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the third-party PHP package
axyr/laravel-langfusevia Composer (composer require axyr/laravel-langfuse). This package is used for automated instrumentation and data ingestion into Langfuse. - [COMMAND_EXECUTION]: Provides a shell snippet using
curlandbase64to test connectivity to the Langfuse API. This command uses the user's local environment variables (LANGFUSE_PUBLIC_KEY,LANGFUSE_SECRET_KEY) to generate an authorization header for a status check. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the tracing of LLM prompts, completions, and tool results. This creates a surface where malicious instructions embedded in processed data could be ingested into the Langfuse dashboard.
- Ingestion points: LLM input/output and tool arguments captured by
LaravelAiSubscriberinSKILL.md. - Boundary markers: None mentioned for the tracing payload itself.
- Capability inventory: Performs network operations to send traces to the Langfuse API.
- Sanitization: Recommends masking or excluding Personally Identifiable Information (PII) from trace inputs and metadata.
Audit Metadata