langfuse-migration-deep-dive
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses dynamic context injection (
!npm list...) inSKILL.mdto check for the presence of required packages in the local environment. This is a benign use of the feature for environment validation. - [DATA_EXFILTRATION]: While the skill scripts read data from one Langfuse instance and write to another, this is the core intended purpose of the migration skill. The scripts use environment variables for authentication and do not target unauthorized third-party domains.
- [CREDENTIALS_UNSAFE]: The skill correctly instructs users to manage sensitive API keys via environment variables (e.g.,
SOURCE_LANGFUSE_SECRET_KEY) rather than hardcoding them. The presence of placeholder keys likepk-lf-source-...in documentation is standard and safe.
Audit Metadata